The cyberattacks in Spain in 2026 They pose risks to business operations and customer data. Recent publications allow us to analyze what is happening, although their figures measure different realities: observed attacks, reported breaches, and support requests.

The year's assessment is still ongoing. To understand the threats, it's important to read each indicator within its context and examine specific cases, such as the Adif and Renfe incident. This combination helps determine what to protect and how to prepare a response.

What data do we have on cyberattacks in Spain in 2026?

In a publication dated October 5, NTT DATA reported that 879 attacks identified in their sample from the first half of 2026, compared to 605 in the second half of 2025: an increase of 45%. This is an observation from their threat intelligence team, not a count of all attacks that occurred in Spain. You can consult the NTT DATA analysis of incidents observed in Spain.

For its part, the Spanish Data Protection Agency (AEPD) announced on October 20 that it had received 3,027 notifications of personal data breaches between January and June, compared to 1,271 in the same period of 2025, an increase of 138%. AEPD note on the gaps in the first half of 2026 It measures notifications received by the authority, a different category from attacks observed by a security provider.

The Ministry for Digital Transformation published another indicator: INCIBE's 017 service attended 95,064 queries between January and June 2026, compared to 49,599 a year earlier. Balance of inquiries to 017 during the first half of the year It reflects a demand for help and advice; it does not equate to that number of companies attacked.

Indicator	Data published	Period	What does it represent?
NTT DATA	879 attacks; +45 %	First half of 2026	Observed sample; comparison with the previous semester
AEPD	3,027 notifications; +138 %	First half of 2026	Reported gaps; year-on-year comparison
017 of INCIBE	95,064 queries	First half of 2026	Inquiries handled through the service

These figures they should not be added together. An incident can generate multiple inquiries or communications, and a data breach can also be due to an error or accidental loss. Furthermore, neither of these factors alone allows for calculating the probability of a specific company suffering an attack.

Which threats should be monitored?

Phishing and identity theft

Messages that impersonate a company or colleague aim to trick the victim into providing information, clicking on a link, or authorizing a transaction. A hypothetical example is an email requesting a change of supplier account, using the supplier's name and a previous invoice to appear credible.

When faced with a sensitive request, verify the sender's identity through a known channel and check the actual destination of any links. A professional-looking message is not necessarily authentic. To learn more about these red flags, you can read... How modern phishing works and how to detect it.

Ransomware and extortion

Ransomware can prevent access to information and affect business continuity. INCIBE explains its entry points and recommends not paying the ransom, because doing so does not guarantee data recovery. ransomware help resource It includes prevention and recovery guidelines.

For an organization, the practical question is how long it would take to recover its essential services. A backup needs to be restoreable; furthermore, the recovery process must prevent an ongoing intrusion from compromising the systems again.

Access from connected providers and services

A company's security also depends on the connections and permissions it maintains with third parties. It's important to know which provider can access which systems, who authorizes that access, and how it's withdrawn when it's no longer needed.

An inventory of applications, accounts, and services allows you to locate dependencies that might otherwise go unnoticed. Reviewing these relationships helps both to prevent unnecessary access and to identify who to notify during an incident.

The Adif and Renfe case as an example of interconnected systems

In its statement of September 25, Renfe placed the evidence of the incident's origin on Adif servers that had been previously compromised and connected to the operator's systems. It explained that it had isolated the affected environments and that rail service remained operational. Official statement from Renfe regarding the incident It allows us to distinguish the impact on information regarding the functioning of transportation.

He Adif's notice regarding potentially affected data The entity mentions the bidding platform and corporate systems. It clarifies that the categories described are potential scenarios and do not imply that all individuals or their data will be affected. This distinction is important when interpreting news about leaks.

In our analysis of cyberattack on Adif in September 2026 You can consult the timeline, the entities' communications, and the recommended precautions. The case illustrates why the technical scope, the data affected, and the continuity of service must be analyzed separately.

What role does artificial intelligence play in these threats?

NTT DATA notes that artificial intelligence can make impersonation and fraud campaigns more believable and scalable. However, this observation does not allow us to attribute all attacks in 2026 to AI, nor does it imply that any specific incident was carried out autonomously. Such attribution requires investigative evidence.

For businesses and users, the practical consequence is to review requests based on their context and the verified identity of the sender. Well-written text, a recognizable voice, or a personalized message are not enough to authorize a payment or provide credentials.

How can companies prepare for a cyberattack?

He INCIBE's ten-point cybersecurity guide for companies It proposes analyzing risks, controlling access, updating systems, and testing backup restoration. To turn these guidelines into daily work, it's advisable to assign responsibilities and verify the effectiveness of each measure.

• Prioritize critical assets. Identify what information and services the company needs to continue operating and what the consequences of losing them would be.
• Check access and permissions. Remove unused accounts, limit privileges, and strengthen authentication for critical accounts, including third-party access.
• Plan the updates. Maintain an inventory and process to assess and correct vulnerabilities based on the exposure of each service.
• Test the recovery. Verify that the backups allow data restoration and that the team knows the service recovery order.
• Rehearse the answer. Define who coordinates the incident, who keeps the evidence, and who communicates with customers, suppliers, and authorities when appropriate.

To expand the measures according to your organization's environment, consult our guide on Cybersecurity threats in 2026 and protecting businesses. This analysis of data and the Adif case complements that preventative vision.

What to do if you suspect you've suffered an attack

Activate the response procedure and notify the responsible team. Retain all messages, logs, and other available evidence. If ransomware is suspected, INCIBE recommends isolating affected computers from the network to limit its spread; recovery should be coordinated with specialized support.

The INCIBE's help for companies affected by ransomware It provides guidance and contact methods. If personal data is involved, those responsible must assess the notification and communication obligations applicable to the case. Restoring service does not replace investigating the extent of the incident.

Frequently asked questions about cyberattacks in Spain in 2026

How many cyberattacks have there been in Spain in 2026?

The sources cited do not provide a complete and consolidated count for the entire year. The 879 attacks correspond to the NTT DATA sample for the first half of the year. The figures from the Spanish Data Protection Agency (AEPD) and the 017 helpline measure other indicators.

A data breach always equates to a cyberattack

No. A breach can compromise the confidentiality, integrity, or availability of personal data due to an attack, but also due to other causes. Therefore, the two terms should not be used interchangeably.

The Adif case means that all travelers are affected

No conclusions can be drawn from the aforementioned notices. It is necessary to consider the communications from each entity and the scope of the data they describe, without converting potential scenarios into confirmed impacts.

Get trained to analyze and respond to cybersecurity incidents

Interpreting an alert, investigating access, or preparing for recovery requires technical knowledge and sound judgment in working with evidence. The 2026 case studies connect these tasks to problems affecting organizations and users.

If you want to develop your training in this area, check out the EIP program and consider its focus on offensive and defensive security, risk management, and incident response.Learn about the EIP Master's in Cybersecurity and request information