Barcelona Startups Combat 26% Surge in Cybersecurity Attacks

Barcelona’s tech ecosystem is getting a blunt wake-up call. Spain logged 122,223 cybersecurity incidents in 2025, a 26% jump from the prior year, and phishing alone accounted for 25,133 cases, according to data from NetGuardia’s Barcelona Cybersecurity Congress briefing. For a city that fancies itself Europe’s next big tech hub, the numbers are uncomfortable reading.

The attacks aren’t just a national problem. By May 2025, Barcelona City Council had already recorded over 25,000 security incidents, driven predominantly by phishing campaigns and distributed denial-of-service attacks traced to pro-Russian groups. The Catalan Cybersecurity Agency handled 3,372 attacks in 2024, a 26% rise from 2023, mostly credential leaks and unauthorised email access. The threat is local, persistent, and accelerating.

Startups caught in the crossfire

Catalonia’s cybersecurity sector now includes more than 550 companies employing 10,600 professionals. The Generalitat launched an €18.6 million strategy to boost professional training and public awareness. But the helpline numbers tell a more sobering story. The 017 Cybersecurity Helpline received 142,767 inquiries in 2025, and 51% of those calls were reactive, placed after damage had already been done.

That reactive posture is exactly what worries founders and investors in the 22@ district. For every startup that bakes security into its product from day one, there are several that treat it as an afterthought. The city’s vibrant tech community, concentrated around the Glòries hub and spilling into Poblenou, has become a target precisely because it’s a concentration of valuable data and fledgling security practices.

Prevention still playing catch-up

The incidents reported by the council and the Catalan agency are mostly classified as “minor”, leaked credentials, unauthorised access to corporate email. But minor scales quickly when you’ve got tens of thousands of cases. The 26% year-on-year increase in incidents handled by the Catalan agency mirrors the national trend, suggesting the problem is structural, not seasonal.

Trend Micro recently chose Barcelona to open a new operations centre, according to Invest in Catalonia, a sign that the multinational security players see the market’s potential. Yet the local sector remains fragmented. The €18.6 million government strategy is designed to consolidate efforts, but rolling out awareness campaigns across a region with 550-plus vendor firms and 10,600 experts is a coordination puzzle.

What happens next depends on whether the tech scene shifts its mindset. The 017 helpline data makes the case: half the calls come after the breach. If Barcelona wants to cut that ratio, its startups will need to treat security as a competitive advantage, not a compliance checkbox. The infrastructure, the companies, the talent, the public investment, is already here. The missing piece is the urgency.