In 2024, Spain has experienced a concerning increase in the number and sophistication of cyberattacks, affecting companies, public agencies, and businesses. This phenomenon has sparked a national reflection on cybersecurity and the necessary measures to mitigate these risks. In this Befree blog, we will explore the most affected sectors, the factors that have driven this increase, and how companies can prepare to face these threats.
Most Affected Sectors
Cyberattacks have hit various sectors, from large companies like Banco Santander and Iberdrola to public agencies like the DGT and several municipalities. The education and commercial sectors have also been vulnerable, with institutions like the Complutense University of Madrid and companies like Decathlon suffering security breaches. Additionally, critical infrastructure, including government websites and key ports, has been a frequent target.
Factors Behind the Increase
The rise in cyberattacks in Spain can be attributed to several key factors. The increased digitization of companies and services has expanded the attack surface, allowing cybercriminals to find more vulnerable points to exploit. Additionally, the sophistication of these attacks has increased, becoming more complex and harder to detect, which enhances their effectiveness.
Economic and geopolitical motivations have also played a significant role, with many attacks driven by the desire to obtain large financial rewards or influence international politics. Moreover, the increased mobility and connectivity of devices and users have created new opportunities for attackers by expanding the number of possible attack vectors.
Finally, regulations like the General Data Protection Regulation (GDPR) and the European NIS Directive have forced companies to report incidents, which has increased the visibility of cyberattacks and the perception of vulnerability.
Types of Cyberattacks
Among the most common cyberattacks in Spain in 2024, ransomware remains one of the most prevalent, with attackers encrypting data and demanding a ransom for its release. Phishing, through fraudulent emails, continues to be a popular tactic to deceive individuals and steal sensitive information.
Social engineering is another technique used to manipulate individuals and gain access to confidential information. Additionally, supply chain attacks have increased, where cybercriminals infiltrate suppliers to access larger networks. Finally, deepfakes, which use artificial intelligence to create convincing but false content, have begun to gain ground as an emerging threat.
Preparation and Response
While completely avoiding cyberattacks is extremely difficult, there are key measures that can significantly reduce the risk. A recent example is the incident on July 19, 2024, when a configuration update to CrowdStrike’s Falcon sensor for Windows systems caused an error resulting in system crashes and blue screens (BSOD) across multiple industries, including airlines, banks, and broadcasting services. Although it was not a cyberattack but an update error, companies had no choice but to test their contingency plans.
This incident offers valuable lessons for strengthening preparedness against cyberattacks. Here are some key points to consider:
- Well-defined contingency plans
- Effective communication and coordination
- Employee education and awareness
- Data encryption
- Multi-factor authentication
- Real-time monitoring
In summary, the wave of cyberattacks in Spain in 2024 highlights the urgent need to strengthen cybersecurity. Companies must adopt proactive measures to minimize risks and be better prepared to face potential threats.
