In recent months, Spain has come under the European Union’s spotlight due to serious cybersecurity issues. The country’s authorities failed to implement the NIS2 European directive on time, leading to a number of high-profile data leaks involving senior officials. This situation is already undermining trust in government institutions and could trigger financial sanctions from the EU.
According to EL ESPAΓOL, last year alone, the number of cyberattacks targeting Spanish companies and government agencies rose by 26%. Among those affected were FiscalΓa, PolicΓa Nacional, Guardia Civil, and Consejo de Seguridad Nacional. The most alarming period came between February and March, when the personal data of President Pedro SΓ‘nchez, ministers, and security chiefs was compromised. During that time, the Moncloa security system went nearly a hundred days without updates, enabling hackers to access confidential information.
EU response
The European Commission has already launched an official investigation into Spain. In November 2024, the country received a warning, followed by a reasoned opinion in May 2025. The next step is to refer the case to the EU Court, which could result in fines and the loss of part of European funding. MEP Juan Ignacio Zoido has addressed the European Commission with questions about risks for the continent and possible measures to prevent similar incidents. He stressed that delays in adopting cybersecurity legislation pose a threat not only to Spain but also to other EU countries.
The situation is further complicated by the fact that Spain ranks first in the European Union for the number of unimplemented directivesβalready 101, of which 50 are overdue. There are 92 open cases in the country concerning breaches of European legislation, with two already resulting in financial penalties. According to russpain.com, Spainβs deficit in implementing European regulations is three times the EU average and continues to grow, driven by the political crisis and lack of a stable majority in parliament.
Consequences for government bodies
Recent attacks targeting the FiscalΓa, PolicΓa Nacional, and Consejo de Seguridad Nacional occurred within a single week, raising alarm in Brussels. As a result, not only were personal details exposed, but work credentials of hundreds of security service staff were also compromised. Experts warn these leaks could threaten both national and pan-European security. Concerns also stem from Spain’s failure to implement the so-called 5G Toolbox, which restricts the use of equipment from high-risk suppliers such as Huawei and ZTE in critical communication networks.
The European Commission has already raised concerns about Spainβs Interior Ministry contracts with Huawei, pointing to the risks of relying on a single supplier and the possibility of foreign interference. Against this backdrop, dissatisfaction with Spainβs government is growing in Brussels, with many feeling Madrid does not take cybersecurity issues seriously enough.
Incidents and diplomatic fallout
Cybersecurity issues have already led to diplomatic incidents. After Donald Trumpβs public remarks addressed to Spain, German Chancellor Friedrich Merz was unable to contact Pedro SΓ‘nchezβhis number had been changed for security reasons following another data leak. The incident came to light just two days after news broke about the Consejo de Seguridad Nacional hack which exposed the addresses and emails of the president and several ministers.
The Moncloa security system became outdated back in November 2025 when the manufacturer ended support. A new contract was not signed until February 2026, leaving government servers vulnerable to sophisticated attacks for nearly one hundred days. As noted by EL ESPAΓOL, such failures not only result in data leaks but also cause real economic losses and pose a threat to national security.
Context and similar incidents
In recent years, Europe has faced a surge in cyber threats, and Spain has been no exception. In 2024, the issue of technological independence and the risks related to control over artificial intelligence were debated in detail in a report on digital challenges for Europe β an analysis of the technology market situation showed that delays in regulation can have long-term consequences. Similar data leaks have already occurred in other EU countries, but such large-scale attacks targeting top government bodies are being recorded for the first time. Experts note that without the rapid introduction of new cybersecurity standards, the situation may only worsen and trust in state institutions may decline.
