Why Spain ranks among the most vulnerable countries to cyberattacks

Spain has become one of the top targets for cybercriminals worldwide after a recent surge in cyberattacks against major institutions.

The scale of the threat

Spain faces growing cyber risks. In recent months, major breaches hit Telefónica, the country’s leading telecom provider, Santander Bank, the Orange phone network, Iberdrola energy, several listed companies, and even the Armed Forces. Nearly one-third of attacks target public administrations.

While the nationwide blackout on April 28 was officially not linked to a cyberattack, doubts remain due to insufficient evidence.

Cybersecurity firm Secure&IT’s CEO Francisco Valencia highlights Spain’s rising position in global cybercrime rankings. Spain moved from fluctuating between third and fifth place in previous years to second place in 2025.

Reasons behind Spain’s vulnerability

- Spain experienced a 35% increase in cyberattacks this year, with over 45,000 daily incidents.

- From late February to early March, attacks surged by 750% compared to last year, according to HackManac.

- During the week of March 5-11, Spain was the most targeted country worldwide.

- It is also the third most attacked country by pro-Russian hackers.

Spain’s global commercial presence and significant GDP position it as a strategic target. Its geographical location on Europe’s western edge links Europe to America, raising its strategic importance.

Valencia compares Spain to the UK’s previous role as a top target before Brexit due to its capacity to destabilize the EU. Spain briefly dropped in rankings at the start of the Russia-Ukraine conflict but has since become a prime target again.

Digital transformation and security gaps

Spanish companies have rapidly digitized, encouraged by the EU’s Next Generation Funds. However, many did not invest enough in cybersecurity, leaving them exposed to attacks.

Ransomware attacks increased by 120%, causing substantial financial losses, especially for small businesses. Losses range from €2,500 to €60,000 per attack for small firms, and over €5.5 million for large companies, according to CybersecurityNews.

Government response

The Spanish government has not officially commented on the rankings but acknowledges the rising cyber threat.

Prime Minister Pedro Sánchez stated that Spain faces over a thousand cyberattacks annually targeting essential services and critical infrastructure. Many attacks remain unreported publicly but affect hospitals, airports, and other vital sectors.

Sánchez announced plans to enhance telecommunications and cybersecurity capabilities through investments in satellites, 5G, artificial intelligence, quantum computing, and cloud infrastructure. The goal is to establish a “digital shield for Spain.”

The global cost of cybercrime

Secure&IT reports cybercrime now costs 1.5% of the world’s GDP. In 2024 alone, cyberattacks rose by 64%, according to Spanish cybersecurity company CCN-CERT.

Valencia emphasizes the attractiveness of cybercrime: it is profitable, scalable, and anonymous. Malware providers even have reputation platforms, indicating the growing sophistication of digital crime.