Digitalization has transformed the way in which organizations carry out their activity. The automation of processes, agile access to information and the incorporation of new technological tools have contributed to improving efficiency and service provision. However, this growing dependence on digital systems has also expanded the attack surface and exposure to cybercrimes, making the protection of data and technological infrastructures a priority.
A cyber attack no longer only represents a risk to the confidentiality of information. It can also interrupt processes, compromise daily operations and make business continuity difficult. In this scenario, the increase in cybercrimes forces companies and institutions to reinforce their prevention and response strategies, especially in those sectors that manage sensitive information or depend on their technological systems to provide essential services.
The digital threat grows in Spain
The data from the Ministry of the Interior reflects the dimension that cybercrime has acquired in Spain. Cybercrimes have gone from 92,716 known events in 2016 to 488,426 in 2025, which represents an increase of 427% in less than a decade. Between 2024 and 2025 alone, cases increased by 5.1%, going from 464,801 to 488,426.
The weight of these crimes within the set of registered criminal offenses also shows the magnitude of the problem. In 2025, cybercrimes represented 19.8% of the total criminal offenses known to the State Security Forces and Bodies. In other words, practically one in five recorded crimes was related to the use of digital technologies.
«These figures show that cybercrime can no longer be considered a specific threat or limited to certain organizational profiles. The volume and evolution of attacks make it necessary for cybersecurity to be part of the strategy of companies and entities, with prevention and protection measures adapted to the risks to which they are exposed,” explains Ruth Cuscó, managing director of ASHO.
The challenge of the healthcare sector to protect sensitive information
Within this scenario, the healthcare sector faces particular challenges. Hospitals, health centers and other healthcare organizations manage medical records, medical reports, diagnostic test results and other especially sensitive personal data on a daily basis. At the same time, they depend on their technological systems to guarantee the operation of their services.
This combination makes healthcare entities an area especially exposed to the consequences of cybercrimes. A security breach can compromise patient privacy, while a ransomware attack or systems outage can make it difficult to access clinical information and affect the work of professionals.
«Health cybersecurity must protect the confidentiality and integrity of information, in addition to helping to preserve the continuity of services. In the face of phishing, unauthorized access, leaks or ransomware, it is necessary to combine technology, training and prevention, response and recovery capacity,” explains Alex Galussio, cybersecurity expert at ASHO.
The impact of these incidents therefore goes beyond the possible theft or leak of data. An attack can prevent access to essential information for healthcare activity for hours or even days, hinder the work of professionals and alter the normal functioning of the centers. Therefore, preventing cybercrimes and minimizing their consequences is essential to protect both information and the continuity of health services.
Prevention, first line of defense
Against this backdrop, healthcare organizations must address cybersecurity from a comprehensive perspective. Protection against cybercrimes requires combining technological solutions, action protocols and measures aimed at reducing the risks associated with the daily use of digital systems. The identification of vulnerabilities, updating tools and training professionals constitute some of the pillars of this strategy.
“We must segment the network using VLANs and control the traffic between them, as well as maintain the routers and firewalls with periodic reviews of their rules and configurations, and update the firmware, operating systems and applications of the equipment,” says Galussio.
An attack can prevent access to essential information for healthcare activity for hours or even days.
At ASHO, this approach translates into concrete measures, such as two-factor authentication for remote access, the application of security policies on computers, monitoring events, and periodically reviewing exposed configurations and services.
Continuous monitoring also plays an important role in early detection of potential incidents. “The IT department works together with the quality area and carries out biweekly reviews, preserving evidence of the controls carried out, with the aim of identifying deviations and following up on corrective measures,” explains the expert.
Added to these measures is the need to have protected backup copies and periodically check that data and services can be recovered. This capacity is essential to limit the impact of cybercrimes and restore activity in the shortest possible time after an incident.
“It is not enough to have a copy: you have to check that it allows data and services to be restored when they are needed,” concludes Galussio.
In short, the increase in cybercrimes reinforces the need for healthcare organizations to integrate cybersecurity into their daily management. The combination of prevention, monitoring, training and recovery can reduce risks and protect an essential asset: patient information and continuity of care.
