Spain has slipped onto the ransomware black map and is already among the countries hardest hit in the world by this type of attack, with a direct impact that is beginning to be felt in the courts. As the numbers grow, lawyers are bracing for a new wave of cyberlitigation where digital evidence will be the center of the battle.datacentermarket+4
Spain, the new epicenter of ransomware
According to Thales’ Threat Landscape Report 2025, Spain ranked in 2025 as the sixth most affected country in the world by ransomware attacks, with 85 incidents in the second half of the year and 164 in the year as a whole. Globally, 7,701 attacks were registered, 51.5% more than the previous year, which confirms that the phenomenon is not temporary but an upward trend.elchapuzasinformática+4
Data from the insurance sector reinforces the same idea: the frequency of cyber claims in Spain soared by 143% in 2025, according to the latest Cyber Claims Report released in March 2026. The underlying message is clear: Spanish companies are increasingly attractive targets for criminal groups that have professionalised their operations.redestelecom+6
Thales’ own report points to a more competitive and fragmented ecosystem, driven by geopolitical tensions and a clandestine market that is very active on the dark web, where the sale of databases and initial access to corporate networks proliferates. For law firms, these numbers are not a technical curiosity, but a preview of what will arrive on their desks.datacentermarket+1
From Encryption to Extortion: Changing the Crime Model
Ransomware is no longer just about encryption and ransom. Recent cybersecurity reports describe a clear shift toward «extortion-only» models, in which the attacker prioritizes stealing information and the threat of leaking it over locking down systems. The logic is simple: less technical complexity, more speed and greater reputational and regulatory pressure on the victim.ciberseguridadtic+4
This tactical change is combined with double and triple extortion formulas, where the leakage of sensitive data and, in some cases, attacks on customers or suppliers of the affected company are added to the equation. Generative artificial intelligence is also beginning to be used to refine phishing campaigns and automate entire phases of the attack, from reconnaissance to data exfiltration.cybersafety+2
In this scenario, the management of digital evidence ceases to be a technical detail and becomes a critical element of the legal strategy. It’s not just about restoring systems, but about documenting what happened, what was stolen, and how the incident was handled from the get-go.
Endesa, the warning that no one can ignore
The attack on Endesa Energía at the beginning of 2026 has been, so far, the most mediatic case in Spain. A hacker managed to gain access to the company’s trading platform and claimed to have compromised data on about 20 million people, including identity documents, contact details, contract information, and account numbers (IBAN).adslzone+6
The attacker claimed to have exfiltrated more than a terabyte of information and announced the sale of part of the database through Telegram, in addition to posting samples on dark web forums. While the police forces investigated the case, Endesa took several days to publicly communicate the breach, a chronology that has been reconstructed by media such as Xataka, Maldita and various national newspapers.vozpopuli+6
From a legal point of view, the incident concentrates all the pieces of the new puzzle:
- Obligations to notify the AEPD within a maximum of 72 hours from the time of becoming aware of the breach, in accordance with the GDPR. [digitalexpert]
- Need for a rigorous forensic investigation to determine the attack vector, the actual scope of the compromised data, and the actions taken before and after the incident.cybersecuritytic+1
- Management of possible complaints from those affected, which will require a precise reconstruction of what happened and what personal information was actually affected. [digitalexpert]
What happens in court with the Endesa case will be, in all likelihood, a reference for many future litigations.
August 2026: The regulatory «triple pressure» arrives
As the attacks grow, the European legal framework is also tightening. August 2026 marks a turning point with the convergence of three key standards that will fully affect organisations operating in the European Union.
On the one hand, the NIS2 Directive significantly expands the number of sectors and entities obliged to adopt enhanced cybersecurity measures and to report incidents early. Various analyses summarize this area in 18 «critical» sectors, with notification times that combine an initial alert in 24 hours and a more detailed report in 72 hours. The directive also introduces the responsibility of senior management, which could face personal sanctions in the event of serious breaches. [digitalexpert]
In parallel, Regulation (EU) 2023/1543 on electronic evidence – known as the EEvidence Regulation – will begin to apply on 18 August 2026. It will allow the authorities of a Member State to directly request service providers established in another State to retain or produce data for criminal purposes, with response times that, in emergency situations, can be as little as 8 hours.revistasmarcialpons+1
In addition, the Artificial Intelligence Regulation (AI Act), which adopts a risk-based approach and provides for penalties of up to 7% of global turnover for the use of prohibited AI systems or particularly serious breaches. Although the application of the AI Act is phased, the summer of 2026 will see the entry into force of very relevant obligations for developers, providers and users of high-risk systems. [digitalexpert]
For law firms, this triple pressure isn’t just a compliance challenge for their clients. It is also a new terrain where responsibilities will be decided and evidence will be discussed.
Forensic evidence, at the center of the lawsuit
In cyber litigation, the difference between winning and losing is often played out in the quality of the forensic evidence provided to the procedure. Spanish procedural law is based on the free judicial assessment of evidence, but that freedom is conditioned by the possibility for the opposing party to challenge the authenticity of electronic documents.
The Civil Procedure Law dedicates Article 348 to expert evidence and Article 384 to the probative value of reproductions of words, sounds, images and media that collect data, precepts that doctrine and forensic practice fully apply to digital evidence. If a party questions the integrity of an email, server log or instant messaging chat, it will be necessary for a computer expert to explain to the judge how that data was obtained and why it can be considered reliable. [ppl-ai-file-upload.s3.amazonaws]
At recent cybersecurity conferences held at Spanish universities, such as the CIBÉRTICA 2026 meeting at the University of Jaén, experts have insisted that not all information extracted from a device is automatically valid as evidence. For evidence to hold up at trial, proper forensic extraction, the calculation of fingerprints (hashes) that prove integrity and exhaustive documentation of the chain of custody are essential. [ppl-ai-file-upload.s3.amazonaws]
WhatsApp messages, access logs, document metadata or traces of cloud activity can become key pieces of a civil, criminal or contentious procedure, but they can also be discarded if there are doubts about how they were obtained or manipulated. That fine line is what will mark a large part of the litigation for cybersecurity incidents in the coming years. [ppl-ai-file-upload.s3.amazonaws]
Offices in prevention mode: protocols, technology and training
Preparation for these cyber litigations does not begin when the client receives notification from the AEPD or a class action, but well before. Law firms that want to play a relevant role in this new scenario are beginning to adopt four clear lines of action. [ppl-ai-file-upload.s3.amazonaws]
First, they design internal protocols for the preservation of digital evidence to act from the first minute in the event of an incident. Knowing which systems to shut down, which records to keep, and who to call makes the difference between a well-documented case and an incomplete puzzle. [ppl-ai-file-upload.s3.amazonaws]
Secondly, they invest in tools capable of managing massive volumes of information without losing evidentiary traceability: digital evidence management platforms, ediscovery solutions and systems that guarantee integrity through cryptographic techniques. A case like Endesa’s, with more than a terabyte of data compromised, far exceeds what can be handled with folders and spreadsheets.escudodigital+3[ppl-ai-file-upload.s3.amazonaws]
Thirdly, they build collaborative networks with qualified computer forensic experts. The European Union is making progress on certification schemes and common standards in cybersecurity and digital forensics, which reinforces the importance of working with accredited and experienced professionals in court.revistasmarcialpons+1[ppl-ai-file-upload.s3.amazonaws]
Finally, they spend time training on the new regulatory framework: NIS2, EEvidence and AI Act are not just acronyms, but rules that will define the arguments, the burden of proof and the penalties in the litigation to come. For many law firms, this knowledge will be a differentiating factor compared to the competition.linkedin+2
Bad news… with opportunity reading
The fact that Spain is among the countries most affected by ransomware is, without a doubt, bad news from the perspective of security and digital trust. But it is also an indicator that a growing demand space is opening up for legal services specializing in cybersecurity, data protection and incident management.businessinsider+7
Firms that systematically integrate digital evidence into their practice, understand the new European framework and rely on appropriate forensic technology will be better placed to accompany their clients when a serious incident occurs – rather than if it does occur. In this context, solutions such as Probatia, focused on the management of electronic evidence and the preservation of the chain of custody from the first minute, aim to become natural allies of the Spanish legal sector.revistasmarcialpons+1[ppl-ai-file-upload.s3.amazonaws]
