Spain

Analyse

Primarily a target — 41 received· 1 initiated· 12 responses ·EU · NATO

This year to date, 41 new cyber operations involving Spain were added to the database: a 17% increase compared to the previous period. The number of operations is currently 1% below the long-term year-to-date average. The Intensity of cyber operations involving Spain over this year to date is declining to 3.1, compared with 3.4 in the same elapsed span of the previous year. This is above the all-time average for Spain of 2.8.

Maintained by EuRepoC research analysts · updated 16 Oct 2026

41received initiated1

For this year to date, this country appears chiefly as a target — 41 incidents directed at it, 1 it is linked to initiating.

Source: EuRepoC Global Database as of 16 Oct 2026.

01 / 02

Cyber activity

41 incidents · as target

As target 41 As actor 1

Incidents directed at Spain targets, and the responses they drew.

Cyber incident intensity

Mean3.5/15Moderate

Range 1.0–8.0

Drag the ends of the observed range to narrow intensities.

Minimum Maximum

40 coded incidents · This year to date

Database additions by monthincidents against Spain

Bar height shows incidents added during this year to date; select a bar to filter this interval; hover for average intensity.

Most-targeted sectorswhat gets hit

SectorIncidentsIntensityResponded

Civil service / administration 13 3.1Moderate 7/13 Government / ministries 12 2.4Moderate 4/12 Corporate Targets 9 3.3Moderate 2/9 Transportation 6 3.3Moderate 1/6 Education 6 3.5Moderate 3/6 Energy 5 4.2Moderate 2/5 International / supranational organization 5 3.8Moderate 1/5 Finance 5 2.6Moderate 1/5

Civil service / administration is the most-targeted sector — 13 of 41 incidents, 7 answered.

By originwho is behind activity against it

Russia 5incidents avg 4.0 · Moderate Iran, Islamic Republic of 3incidents avg 3.7 · Moderate China 2incidents avg 4.0 · Moderate Korea, Democratic People's Republic of 1incident avg 4.0 · Moderate Spain 1incident avg 5.0 · Elevated

02 / 02

Incidents received & responses

AUUSJPDE4 statesjoint WaterPlum Four International Partners Published Joint Security Advisory on North Korean Cyber Activities on 18 September 2026 Official policy 18 Sep 2026

Official policy 18 Sep 2026

AUUSJPDE4 states WaterPlum

Four International Partners Published Joint Security Advisory on North Korean Cyber Activities on 18 September 2026

Unknown Spain ·Civil service / administration Unknown Threat Actors Conducted Ransomware Attack On Collado Villalba City Council In Spain On 15 September 2026 15 Sep 2026

Incident · Unattributed 15 Sep 2026

Unknown Spain ·Civil service / administration

Unknown Threat Actors Conducted Ransomware Attack On Collado Villalba City Council In Spain On 15 September 2026

Unknown Spain ·Health Unspecified Threat Actor Stole Personal And Health Data Of Patients Participating In Medical Research In Spain On 15 September 2026 15 Sep 2026

Incident · Unattributed 15 Sep 2026

Unknown Spain ·Health

Unspecified Threat Actor Stole Personal And Health Data Of Patients Participating In Medical Research In Spain On 15 September 2026

Unknown Spain ·Transportation Unknown Threat Actors Breached Rail Infrastructure Manager Adif and Railway Operator Renfe in Spain on 24 September 2026 1 Sep 2026

Incident · Unattributed 1 Sep 2026

Unknown Spain ·Transportation

Unknown Threat Actors Breached Rail Infrastructure Manager Adif and Railway Operator Renfe in Spain on 24 September 2026

Kairos Spain ·Civil service / administration Cybercriminal Group Kairos Claimed Breach of Velilla de San Antonio in Spain on 21 August 2026 21 Aug 2026

Incident · Low severity 21 Aug 2026

Kairos Spain ·Civil service / administration

Cybercriminal Group Kairos Claimed Breach of Velilla de San Antonio in Spain on 21 August 2026

USFederal Bureau of Investigation Mabna Institute US Department of Justice Charged 17 Iranians with Cyber Theft on behalf of the Islamic Revolutionary Guard Corps on 18 August 2026 Criminal proceedings 18 Aug 2026

Criminal proceedings 18 Aug 2026

USFederal Bureau of Investigation Mabna Institute

US Department of Justice Charged 17 Iranians with Cyber Theft on behalf of the Islamic Revolutionary Guard Corps on 18 August 2026

Unknown Spain ·Civil service / administration Unknown Threat Actor Launched Ransomware Attack Against Commonwealth De La Hoya De Buñol-Chiva In Spain On 4 August 2026 4 Aug 2026

Incident · Unattributed 4 Aug 2026

Unknown Spain ·Civil service / administration

Unknown Threat Actor Launched Ransomware Attack Against Commonwealth De La Hoya De Buñol-Chiva In Spain On 4 August 2026

Unknown NLFRALAD+4145 countries ·Corporate Targets +1 Unknown Threat Actors Compromised Customer Data Of French Company CEVA Logistics Between 29 July and 1 August 2026 29 Jul 2026

Incident · Unattributed 29 Jul 2026

Unknown NLFRALAD+4145 countries ·Corporate Targets +1

Unknown Threat Actors Compromised Customer Data Of French Company CEVA Logistics Between 29 July and 1 August 2026

Showing the 8 most recent of 53 Open all in advanced search