Cyberfeed6 › Countries › Spain
10 IT, OT and crypto incidents involving Spain are listed for May to November 2026 (10 IT). The most common kinds are ransomware, data breach. The country is where the affected organizations or users are, not where the attackers are.
Fake tax-refund texts steal bank logins
2026-03-12 · Scam campaign · Moncloa (INCIBE)
INCIBE confirmed an active smishing campaign: fake text messages about an income tax (IRPF) refund link to newly registered .es domains that aim to steal bank credentials.
What to do: Do not open links in unexpected texts about money or taxes. Check tax notices only on the tax agency's official site, agenciatributaria.gob.es.
Spain's AEPD logs first breach notification involving an AI agent
IT September 16, 2026 · Data breach · thenextweb.com
Velilla de San Antonio council (Spain), Kairos ransomware
IT August, 2026 · Ransomware · Roundup: Comparitech: ransomware roundup, August 2026
Castilla-La Mancha regional government (Spain), Panzer ransomware
IT August, 2026 · Ransomware · Roundup: Comparitech: ransomware roundup, August 2026
University of Alicante (Spain) ransomware attack
IT July, 2026 · Ransomware · Roundup: Comparitech: ransomware roundup, July 2026
Indra Group (Spain) SafePay ransomware, data leaked
IT July 1, 2026 · Ransomware · cybernews.com
University of Valencia (Spain), Nova ransomware
IT May 25, 2026 · Ransomware · Roundup: Comparitech: ransomware roundup, May 2026
Valdemoro city council (Spain), Kairos ransomware
IT May, 2026 · Ransomware · Roundup: Comparitech: ransomware roundup, May 2026
Notin.es notary software (Spain), Crypto24 ransomware
IT May, 2026 · Ransomware · Roundup: Comparitech: ransomware roundup, May 2026
Mediapost marketing firm (Spain), Qilin ransomware
IT May, 2026 · Ransomware · Roundup: Comparitech: ransomware roundup, May 2026
Zara customer records exposed via third-party database
IT May 8, 2026 · Data breach · bleepingcomputer.com