Spain’s Cibercomandancia de la Guardia Civil, established in León in July 2025, has processed around 50,000 online reports in its first year. Most cases involve digital fraud, and most suspects are based in Madrid, Barcelona and Valencia. The unit, which operates in the same city as the Instituto Nacional de Ciberseguridad (INCIBE), has recovered more than €5.8 million for victims.
Of the 50,000 reports submitted through the Guardia Civil’s electronic portal, 42,000 were formally processed. These included 29,000 criminal incidents and 7,000 cases involving lost documents. The remaining reports were rejected, often because they did not meet legal requirements or did not constitute a criminal offence. Investigators have clarified more than 500 cases, with approximately 600 individuals under investigation. Cyber fraud accounts for 55% of all cases handled by the unit, reflecting the basic role of fraud in its workload.
The Cibercomandancia is the only police body in Spain currently accepting this type of online complaint. Since 2015, only four types of offences could be reported online, and citizens still had to confirm their complaint in person within 72 hours, a process Ángel Blanco, captain of the unit’s judicial police, described as cumbersome. The 2024 reform of the Ley de Enjuiciamiento Criminal (LeCrim) enabled a broader range of crimes to be reported digitally from January 2025, provided the complainant is identified with an electronic certificate. These include online fraud, identity theft, document loss and certain physical crimes such as theft or vehicle damage. Cases where the perpetrator is known, as well as those involving sexual assault or gender violence, are excluded.
Reports have come from across Spain, with the largest numbers originating in Madrid, Valencia, Alicante and Barcelona. In Catalonia alone, between 1,500 and 2,000 reports have been filed, most of them in Barcelona. The unit’s investigators, known as equipos @, report that most suspects are based in major urban centres. By contrast, regions with older populations and less digital engagement, such as Galicia or Castilla y León, see fewer cases.
When a report arrives, agents enter its data into the Sistema Integral de Gestión Operativa (SIGO), making it accessible from any Guardia Civil post. The Cibercomandancia now employs around 100 officers, 15% of whom are women, and has prioritised recruiting younger staff with strong digital skills. The unit receives an average of 180 reports a day, with numbers peaking at 250 on weekdays and falling to around 100 on weekends and holidays.
One of the unit’s basic tasks is to act quickly in urgent cases, such as blocking fraudulent bank transfers. Speed is critical: filing a report within 24 to 32 hours of a suspicious transaction increases the chance of recovering funds. Cases are assigned to whichever team is best positioned to act immediately. In one recent sexual assault case, the victim was able to file a detailed report online after declining to visit a police station, demonstrating the system’s flexibility.
León is also home to INCIBE, which operates under Spain’s Ministry for Digital Change and the Civil Service through the State Secretariat for Telecommunications and Digital Infrastructure. Its public work includes cybersecurity coordination, awareness and incident response, while criminal investigations remain the responsibility of law-enforcement bodies. INCIBE-CERT also provides technical information on topics including authentication and cybersecurity vulnerabilities, a function distinct from the Guardia Civil’s complaint-handling and investigative role.
The city’s broader cybersecurity environment was on display at the twentieth edition of ENISE, held in León from 21 to 23 October 2026. The event brought together 190 companies and institutions and included five international pavilions. INCIBE’s role in this environment provides institutional context for the Cibercomandancia’s location, while the unit’s first-year figures point to large demand for digital policing. The trend reflects broader changes in Spanish law enforcement as authorities adapt to new forms of crime and update procedures. This shift is also evident in other areas, including the recent push for more detailed documentation of violent incidents at sea, as seen in the move by Spain’s anti-drug prosecutor to allow piracy charges for narcolancha attacks.
Cyber incidents can also reach beyond personal data and financial loss to affect physical infrastructure. In a bulletin covering an incident in France, INCIBE-CERT reported that a cyberattack during the night of 11-12 October 2026 compromised remote controls for refrigeration systems at hundreds of supermarkets. As cybercrime continues to evolve, the effectiveness of specialised units such as the Cibercomandancia will be critical to protecting individuals and businesses across Spain.
