Monday, 8:15 a.m. The office manager calls: she can’t open a single invoice, and a note on the screen demands payment in bitcoin. By mid-morning, a client reports a strange email “from you”. This is how a cyberattack on your company usually begins. And what you decide over the next few hours matters as much as the attack itself.
The short answer: isolate the affected devices without deleting anything, and preserve the evidence. Find out which personal data has been affected and document everything. If there is a risk to people, notify the Spanish Data Protection Agency (AEPD) within 72 hours, and inform those affected when the risk is high. Afterwards, the AEPD will not only ask what happened. It will ask what measures you had in place beforehand. In the three sanctioned cases below, fines range from €3,000 to €680,000.
In this article we will discuss...
A cyberattack on your company is almost always a personal data breach
When an attacker encrypts your servers or takes information, data about clients, employees or suppliers is usually involved. The GDPR calls this a “personal data breach”. It covers theft or leaks, and also loss of availability: if you cannot access your data because it has been encrypted, that is a breach too.
This has three practical consequences:
- Every breach must be recorded internally, even if it does not have to be notified (Article 33(5) GDPR).
- The AEPD must be notified without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people.
- Those affected must be informed without undue delay when the risk is high (Article 34 GDPR).
What to do after a cyberattack on your company: the first 72 hours
First hours: contain without destroying evidence
- Isolate the affected devices from the network, including remote connections and the VPN, so the attack does not spread.
- Do not delete or reinstall anything yet. Logs, suspicious emails and the ransom note are the evidence that technicians, the police and later the AEPD will need.
- Change the passwords of any accounts that may be compromised, starting with administrator and email accounts, and enable two-factor authentication if you did not have it.
- Alert your IT provider. If you have cyber insurance, check the deadline it gives you to report the incident.
- Open an incident log with the time of detection, who detected it and every decision taken. The 72 hours run from the moment you become aware, and you will need to be able to prove it.
Within 24 hours: find out which data is at stake
With technical support, answer these questions:
- Which systems have been affected and whether the attacker may have taken information.
- Which personal data was there: identification, bank details, payslips, ID documents, health data…
- Whose data, and how many people: clients, employees, former employees, candidates.
- Whether it was encrypted and whether you have unaffected backups.
You do not need all the answers to move forward. The GDPR allows you to provide information to the AEPD in phases if it is not all available at first.
Within 72 hours: notify and report
- Notify the AEPD through its electronic office if there is a risk to people. If you go beyond 72 hours, the notification must explain the reason for the delay. We explain when it is mandatory in our guide on notifying a data breach to the AEPD within 72 hours.
- File a complaint with the National Police or the Guardia Civil, with the evidence you have preserved.
- INCIBE helpline (017). Spain’s national cybersecurity institute helps businesses free of charge with the technical response. INCIBE recommends not paying the ransom, because paying does not guarantee you will recover your information.
Informing those affected
If the risk is high, for example because ID documents, bank accounts or passwords have been leaked, you must inform the people affected. The message must be clear and simple: what happened, which data is affected, what the company has done and what they can do. For instance, be wary of emails or calls that use that data to deceive them.
Cyberattack on your company: three cases sanctioned by the AEPD
| Company | What happened | Why | Fine |
|---|---|---|---|
| Flexicar | Website form breach, notified on time | Basic security measures missing | €680,000 |
| Coinsoft 21 | Ransomware on an old system | Unencrypted data, no monitoring | €3,000 |
| Vodafone | Attack on its telesales supplier | Security and unsigned processing agreement | €400,000 |
Flexicar, €680,000: it notified properly but lacked basic measures
What happened. Flexicar suffered a confidentiality breach affecting data that users had entered in the contact forms on its website. It notified the AEPD on 3 June 2024 and informed those affected. Even so, several of them filed complaints.
Why it was sanctioned. In decision PS/00540/2025, signed in May 2026, the AEPD found that a number of security measures had not been implemented and were only introduced after the breach. Some were basic. According to the Agency, applying them earlier could have prevented the breach or at least mitigated its effects. It imposed €400,000 for breaching confidentiality (Article 5(1)(f)) and €250,000 for insufficient security measures (Article 32). It added €30,000 because the privacy policy did not properly explain how long data was kept (Article 13).
The lesson. Notifying on time is mandatory, but it does not save you from a fine. What is judged is the security you had before the attack.
Coinsoft 21, €3,000: an old system and former employees’ data
What happened. In June 2024 this company suffered a ransomware attack with data theft, probably after a phishing email. It affected an old system inherited after an acquisition and used only for look-ups. It held data on around 50 people: partners, clients, employees and former employees. The company notified the AEPD two days after detecting the breach. A former employee who had left in 2019 complained: he feared his ID, payslips and severance documents had been exposed.
Why it was sanctioned. Decision PS/00031/2026 records what the company itself admitted. That system had not been properly integrated and lacked standard security measures. The data was not encrypted and there was no monitoring to detect incidents. It could not even confirm how the attacker got in. The fine was €5,000 for breaching confidentiality, reduced to €3,000 because the company accepted responsibility and paid early.
The lesson. Old systems and data you no longer need are the weak spot. If they are not used, delete them, as we explain for a former employee’s email account. And without activity logs, you will not be able to explain what happened.
Vodafone, €400,000: the attack hit its supplier
What happened. In November 2023, an attacker accessed the servers of the company providing telesales services to Vodafone. Personal data from that service was affected, including that of prospective clients. Vodafone notified the AEPD six days after the attack began.
Why it was sanctioned. In decision PS/00253/2025, the AEPD imposed €300,000 for insufficient security measures (Article 32). It added €100,000 because the supplier had processed data for periods without a signed data processing agreement (Article 28). The Agency made clear that audits of the supplier do not replace that agreement.
The lesson. If your supplier is attacked, the fine may land on you. The processing agreement must be signed before the supplier starts processing data, and its security must be reviewed. That is what we do in our third-party risk management service.
Common mistakes after a cyberattack
- Waiting to know everything before notifying. The deadline runs from when you become aware. You can notify with the information available and complete it later.
- Reinstalling devices on day one. You lose the evidence that shows how the attacker got in.
- Paying the ransom in the belief that this avoids a breach. The data has already been taken or encrypted, and your obligations remain.
- Sending those affected a generic message that does not tell them which data is at risk or what to do.
- Forgetting suppliers. If the incident started with one of them, you need their information to notify on time.
How to prepare your company before the next attack
- Backups kept off the network and tested, so you can restore without depending on the attacker.
- Two-factor authentication for email, remote connections and administrator accounts.
- A breach management protocol with owners, phone numbers and templates for notification and for informing those affected.
- An inventory of data and systems, with deletion dates for those no longer in use.
- Processing agreements signed with every supplier that handles data, and a review of their security.
- Phishing training for all staff, as it remains the most common way in.
How we can help
If your company has just suffered a cyberattack, our data breach management service supports you from the first hour. We assess the risk, prepare the AEPD notification and the message to those affected, and document every decision. If you want to prepare before it happens, as external data protection officers we review your measures, your supplier contracts and your breach protocol. Tell us about your case.
Frequently asked questions
Do all cyberattacks have to be notified to the AEPD?
Not all of them, but every one that affects personal data and poses a risk to people does. If the risk is unlikely, you do not notify, but you must record the breach and justify that decision.
When do the 72 hours start?
From the moment the company becomes aware that a personal data breach has occurred. If you cannot notify within that period, you must still do so and explain the delay.
Do clients have to be informed?
Only when the breach poses a high risk to them, for example if bank details, ID documents or passwords have been leaked. The message must be clear and tell them what they can do to protect themselves.
Should I pay the ransom?
INCIBE recommends not paying, because paying does not guarantee you will recover the information. Paying also does not remove the obligation to notify or the risk of sanctions.
Can I be fined if the attack came through a supplier?
Yes. The AEPD fined Vodafone €400,000 over a breach at its telesales supplier, partly because the processing agreement was missing for part of the time.
This article provides general information and is not a substitute for legal advice on a specific case.
