Spain’s Cybercrime Numbers Need Context
Spain’s Interior Ministry reported on 10 July that 488,426 cybercrimes were recorded in 2025, up 5.1% and representing 19.8% of recorded crime. Computer fraud accounted for 429,677 cases. The ministry counted 383,285 victims and 19,876 people detained or investigated, with 14.6% of known cases cleared.
Retrospective coverage: first published 14 October 2026 with a 12 July dateline, two days after the Interior Ministry’s report. The supporting annual-report comparison and October related reading below were added retrospectively. Their availability on 12 July is not assumed.
It separately recorded 90 incidents affecting critical operators, down 43.8%. Transport accounted for 42.2% of that set. This was a defined critical-operator dataset, not another national crime total.
Update: annual-report comparison added 14 October
INCIBE’s 2025 balance, consolidated on 9 February 2026, recorded 122,223 security incidents, up 26%: 55,411 involved malware, 25,133 phishing, 3,849 information theft and 392 ransomware. It also identified 237,028 vulnerable systems. Vulnerable systems are not interchangeable with incidents.
The AEPD’s 2025 annual report recorded 2,765 personal data breach notifications, 81% private-sector and 19% public-sector. Eleven were referred for further investigation; six orders required communication to affected people. Its aggregate potentially affected population exceeded 200 million, not necessarily unique people in Spain. The report also described non-cyber causes, including misdirected or mistakenly displayed data.
A shared incident identity is more useful than one grand total
Adding the three headline counts would create a number with no reliable definition. Crime recording, operational response and data-protection notification answer different questions. Even within an organisation, the same event can generate work in all three channels.
Keep an incident identity that legal, fraud and security teams can share. Then retain each team’s measure and its definition. A board should be able to follow one event from technical containment to customer consequences without treating every record as another independent attack.
- For fraud, track the affected transactions, reports and investigations.
- For operations, track confirmed impact, containment and restored workflows.
- For people, document the data involved, notification decision and communications.
- For every comparison, keep the reporting period, population and measurement method visible.
A falling count is not by itself proof of better security, and a rising count need not describe one consistent change in risk. Ask what was measured, whether the definition changed and what happened to severity and recovery.
Update: related reading added 14 October
BlackTree’s 6 October analysis of Spain’s NIS2 delay is later legislative context. It is not part of the original July statistical announcement.
