Spanish Data Protection Agency reports record security breaches

The Spanish Data Protection Agency (AEPD) has reported a significant surge in personal data breach notifications during the first half of 2026. Between January and June, the agency received 3,027 notifications, representing a 138% increase compared to the same period in the previous year. This figure already exceeds the total number of breaches reported throughout all of 2025.

The AEPD attributes this rise to the growing momentum of cybercrime, specifically noting that ransomware continues to compromise the availability and confidentiality of data across various sectors. In July, a spike in notifications was linked to the hotel industry, where breaches involving reservation management software allowed unauthorized third parties to access customer data and booking information, potentially facilitating fraud.

Separately, the AEPD confirmed through a transparency request that the Ministry of Equality failed to report a security breach involving anti-violence bracelets used by victims of gender-based violence. A technical failure in these tracking devices previously caused false alarms and interruptions in real-time location services. While the Ministry maintained that victims remained protected, the AEPD noted that failing to proactively notify the agency of such incidents can constitute a very serious infringement.