State law enforcement forces and agencies recorded a total of 488,426 cybercrimes in 2025, 5.1% more than in 2024, accounting for 19.8% of total crime. This is set out in the Report on Cybercrime in Spain 2025, produced by the Cybersecurity Coordination Office. The document is available on the Ministry of Home Affairs website, under the section for Situations and Reports in 2025.

Of the total number of cybercrimes reported to the National Police, the Civil Guard, the Navarre Regional Police, the Ertzaintza, the Mossos d'Esquadra and the various local police forces, almost nine out of ten (429,677) were cyber frauds (scams), which rose by 4% compared with 2024.

These were followed, by a wide margin, by cases of forgery committed via the internet (21,690 cases), which accounted for 4.4% of the total, representing an increase of 11.3% compared with the previous financial year.

There has also been an increase in sexual offences (21%), offences relating to unauthorised access and interception (40.7%) and offences involving threats and coercion (2.6%). By contrast, offences against industrial and intellectual property rights have fallen 36%, as have cases of data and system interference, which are down 8%.

The number of people detained and under investigation has risen by 3 %

In 2025, the State law enforcement forces and agencies arrested or investigated 19,876 people, 2.9% more than in 2024. The number of cases solved rose 11.4% and now accounts for 14.6% of all known incidents.

The report states that the typical profile of a cybercriminal is a man (70 per cent of those arrested or under investigation), aged between 26 and 40 (23.7 per cent) and of Spanish nationality (75.7 per cent). By region, Andalusia (89,124), Catalonia (73,400) and the Community of Madrid (72,217) account for 48% of cybercrimes.

The number of victims of cybercrime stands at 383,285, 9.3% higher than in 2024. Fifty-two per cent are men, and the most common age group is 51 to 65, for both sexes, who are mainly affected by scams involving credit or debit cards and traveller's cheques, which have affected 146,737 people.

The incidence of cybercrime is spread evenly throughout the year, although July is the month with the highest number of cases (44,999), followed by May (43,862), September (42,922) and March (42,027). December is the month with the fewest recorded cybercrimes: 36,422.

Cyber incidents that have affected critical operators

The report details the cyber incidents recorded amongst critical infrastructure operators, which suffered 90 cyberattacks in 2025, representing a 43.8% reduction compared with 2024. Most of the incidents were classified as information compromise (32%), followed by those classified as system availability incidents (31%) and, to a lesser extent, fraud (19%).

By sector, transport accounted for 42.2% of cyberattacks, ahead of information and communication technologies (15.5%).

Non official translation