Spain

Spain in the global picture

Spain accounts for 425 of the ransomware disclosures tracked here, ranking #9 worldwide and making up 2% of the global total. The sectors listed most often are Business Services, Manufacturing, Technology.

Who is most active in Spain

Qilin — 72 victims in Spain. Qilin ransomware was first observed in July of 2022. Akira — 22 victims in Spain. The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group. Ransomhub — 20 victims in Spain. The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks.

Where to report an incident in Spain

• CCN-CERT (Spanish Governmental National Cryptology Center - CSIRT) · [email protected] · website
• INCIBE-CERT (Spanish National Cybersecurity Institute - National CSIRT) · [email protected] · website

National computer emergency response teams for Spain, as registered with ENISA and the teams themselves. Regional, sectoral and vendor response teams are excluded; verify current contact details before relying on them in an incident.