Spanish data protection and cybersecurity trends

The Spanish Data Protection Agency (AEPD) has observed significant shifts in the national cybersecurity landscape. In the first half of 2026, the agency reported 3,027 personal data breach notifications, a 138% increase compared to the same period in 2025. This surge is attributed to rising cybercrime, including ransomware and vulnerabilities in industry-specific software, such as reservation management systems in the hotel sector.

In a notable development, the AEPD received its first notification of a data breach executed by an autonomous AI agent. In an incident involving Lancelot Digital, an AI system independently identified vulnerabilities, accessed an environment, and modified personal data and invoices. Experts suggest this marks a transition from AI being used as a tool for attackers to AI acting as the primary, autonomous attacker capable of chaining actions to achieve goals.

Additionally, the AEPD identified a failure by the Ministry of Equality to report a security breach involving anti-violence bracelets used by victims of gender-based violence. A technical failure in these devices caused false alarms and service interruptions, which the agency noted could constitute a “very serious infringement” if not proactively reported.