Cybersecurity in Spain

Cybersecurity in Spain: what is it and why it is key today?

Before "document", "folder" and "desktop" became elements of our computers, they were physical realities that organised corporate life. The first computers were introduced into offices in 1950. Today, computer systems are essential to a company's operations. But with the transition to digital, new risks are emerging. What threats do businesses and users face?

Computer screens displaying graphics and code, with a person working at the keyboard. In the background people can be seen in a high-tech laboratory setting.

In the digital world, cybersecurity is the first line of defence for protecting our information and our privacy.

What is cybersecurity and what does it protect?

In a world where everything is connected and digitised, cybersecurity is a cornerstone of data and system protection. It consists of a set of measures and techniques used to protect computer systems. Everyday actions such as updating your antivirus software or selecting verification tools such as “I’m not a robot” checks are cybersecurity practices that help us prevent digital threats.

Although individuals can also fall victim to cyber attacks, businesses are a prime target for cybercriminals, regardless of the money and data they handle. Cybersecurity is a priority for any organisation, whatever its size or sector.

Cybersecurity in businesses safeguards key elements of their digital infrastructure. This includes the protection of systems, such as networks and devices used daily for work; users' personal data, such as their financial information or other sensitive data, and information relating to the company and its employees; and critical infrastructure, such as energy, health and telecommunications services which, if attacked, could cause major problems for businesses and society.

In 2025, Spain’s National Cybersecurity Institute (INCIBE) handled a total of 122,223 cybersecurity incidents, representing a 26% increase compared to the previous year. These figures highlight the scale of the challenge and the need to implement protective measures at all levels.

Main cybersecurity threats and risks in Spain

There are several digital threats that can affect businesses. Depending on the infrastructure, organisation and security level, cybercriminals use different methods to infiltrate systems. Some of the most significant risks are:

Ransomware

This is malicious software that blocks access to data and systems, demanding a payment or ransom to release them.

Phishing

In this scam, criminals pose as legitimate entities, such as banks or suppliers, to obtain passwords, financial data and other sensitive information.

Data breaches

This is the unauthorised disclosure of confidential data belonging to a company or its customers.

Malware

Software designed to damage or steal information. It usually arrives via emails or unsafe downloads.

Identity theft

Impersonating a company or an employee of the organisation to deceive staff, customers or business partners and obtain information, money or access to systems.

These attacks can result in financial losses, undermine customer trust and disrupt business operations.

What role do cybersecurity companies play in Spain?

The cybersecurity sector in Spain is growing, and includes more than 1,800 cybersecurity providers, driving its evolution. Cybersecurity companies have a responsibility to help their clients tackle cyber threats, but they also play a key role in the growth of this sector in Europe.

With the cybersecurity market projected to reach €3.9 billion by 2027, Spanish companies are driving development through the adoption of emerging technologies and the training of specialised talent, positioning themselves as pioneers and expanding this sector across Europe.

Cybersecurity law in Spain and regulatory framework

In Spain, cybersecurity law is governed by national and European regulations. In 2026, the European Commission proposed new cybersecurity regulations that seeks to strengthen the security of third-country suppliers, simplify the European Cybersecurity Certification Framework and facilitate compliance with cybersecurity standards and risk management requirements for companies operating in the EU.

National regulations also set out cybersecurity obligations in Spain. Laws such as Law 34/2002 on Information Society Services and Electronic Commerce and Law 36/2015 on the Promotion of Business Financing establish requirements to enable companies to operate securely in cyberspace. For example, companies offering online services must provide users with clear information about the company's identity. Laws such as Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights safeguard users' rights to data protection, ensuring that the company processes collected data securely and transparently, and imposing fines of up to €20 million for infringements.

How Iberdrola España operates in terms of cybersecurity

Ensuring cybersecurity is particularly important in sectors such as energy, healthcare and telecommunications. A system failure could cause major problems for society, which is why it is important to protect them with the best technology.

At Iberdrola España we invest significant resources to keep our systems secure, as well as the people who use and manage them. According to INCIBE, 8% of cyber attacks in 2025 were aimed at the energy sector. Our protection begins with our business lines, continues through risk management and concludes with monitoring to ensure our processes are implemented correctly. To achieve this, we rely on innovation and the best professionals, who work in a coordinated manner.

In this regard we are committed to our customers in cybersecurity, providing them with the necessary information to protect themselves from risks and implementing identification, two-factor authentication and secure payment tools to ensure they are safeguarded when using our services.