Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

ES · #9 of 183 countriesWatch Spain

Ransomware Attacks In Spain.

As of Oct 19, 2026, 569 organisations in Spain have been listed as ransomware victims on leak sites, 1.8% of all confirmed victims and rank 9 of 183 countries. The most active group here is Qilin.

Updated continuously · figures as of Oct 19, 2026
Confirmed victims
569
Share of all victims
1.8%
Rank
#9 of 183
Most active group
Qilin
Most hit sector
Consulting

Victims Posted Per Month.

Confirmed ransomware victims in Spain per month
MonthConfirmed victims
November 202512
December 202521
January 202613
February 202616
March 202618
April 202622
May 202623
June 202611
July 202627
August 202618
September 202624
October 2026 (month in progress)14

Most Active Groups Here

  1. Qilin7813.7% of all victims
  2. LockBit 3.0549.5% of all victims
  3. The Gentlemen223.9% of all victims
  4. 8BASE193.3% of all victims
  5. Akira193.3% of all victims

Most Hit Industries Here

  1. Consulting457.9%
  2. Technology457.9%
  3. Manufacturing376.5%
  4. Retail295.1%
  5. Healthcare223.9%

Latest Victims.

All 569 victims in Spain →
Latest confirmed ransomware leak-site victims in Spain
VictimClaimed byCountryIndustryData claimedPosted
Luzco Ilumination
luzco.es
EmperadorESSpainEnergy and Utilities1.4 GB
Correios
correos.es
ShinyHuntersESSpainTransportation and LogisticsNot stated
Torns Enterprises
vicentetorns.com
AkiraESSpainConsultingNot stated
Estrategias BigMat S.L.U.AuroraESSpainRetailNot stated
TTI Algeciras (container terminal operations)
ttialgeciras.com
N0nESSpainTransportation and LogisticsNot stated
Prodiel
prodiel.com
QilinESSpainNon-profit and Civil SocietyNot stated
Medcom Tech Information
medcomtech.com
NightSpireESSpainHealthcareNot stated
DIPECARR
dipecarr.es
EclipseESSpainTransportation and LogisticsNot stated

Know When A Company In Spain, Or One Of Your Suppliers, Is Posted.

Brandefense alerts on leak-site posts for your brands and third parties, with the group's profile and IOC feeds.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.