![\"Data](\"https:\/\/www.arcadsoftware.com\/dot\/wp-content\/uploads\/2026\/05\/data-breaches-spain-AEPD-2026-report-anonymization.png\")
<\/span><\/div><\/div><\/div>By Pierre Henriet \u00b7 May 27, 2026<\/p>\n<\/div><\/div><\/div><\/div><\/div>
357 million people notified of a data breach since 2024. And in the first four months of 2026 alone, the AEPD (Spanish Data Protection Agency) has already received nearly two-thirds of what 2025 saw in total.<\/strong><\/p>\n The AEPD logs the breach notifications it receives and now publishes the details in an interactive dashboard<\/a>: volume, sectors affected, victim profiles, severity, attack methods, and geography. This transparency is valuable. Companies can benchmark their risk exposure, DPOs can build a case for their board, and CISOs can right-size their investments.<\/p>\n \u00bb Read this article in Spanish<\/a><\/p>\n<\/div><\/div><\/div> Key takeaways<\/span><\/p>\n<\/div> 2026 is on track to break records:<\/strong> 1,737 notifications in 4 months, compared to 2,600 for all of 2025.<\/p>\n<\/div><\/li> Tourism and healthcare<\/strong>, the hardest hit with 97 and 93 notifications: two of Spain's biggest industries.<\/p>\n<\/div><\/li> 68% of breaches are intentional<\/strong>: phishing, ransomware, and unauthorized access dominate.<\/p>\n<\/div><\/li> Anonymization, the structural fix<\/strong>: anonymized data that leaks is no longer a notifiable breach.<\/p>\n<\/div><\/li><\/ul><\/div><\/div> The numbers are stark. Between 2024 and April 2026, the AEPD received 7,041 breach notifications<\/strong>: 2,704 in 2024, 2,600 in 2025, and already 1,737 in the first four months of 2026 alone<\/strong>. At this rate, 2026 will easily surpass both previous years.<\/p>\n Even more striking: March 2026 alone recorded 762 notifications<\/strong>, an all-time high. April followed with 502 new notifications. This isn't statistical background noise anymore \u2014 it's a tipping point.<\/p>\n The human scale is staggering: 357 million people notified in total<\/strong>, including 209 million in 2025 alone. The peaks in October and November 2025 (close to 60 million people notified each month) suggest one or more nationwide mega-breaches.<\/p>\n<\/div> The AEPD report tells us a lot about who gets hit. Unsurprisingly, customers and citizens dominate<\/strong> (268 cases), followed by employees<\/strong> (145). Worth noting: leaks affect external data as much as organizations' internal HR data.<\/p>\n The most sensitive number is elsewhere: 113 breaches involve special categories <\/strong>\u2014 data with extra legal protection. And among these, 105 cases involve health data<\/a><\/strong>, whether of patients (80) or employees (25). Then: trade union membership (11), genetic data (6), racial or ethnic origin (5), and more rarely, religion, sex life, or political views.<\/p>\n Severity is mixed: 311 breaches are classified as low severity, 98 as medium severity, and 23 as high severity<\/strong>. Another 69 cases have unknown consequences \u2014 a blind spot worth watching.<\/p>\n<\/div> The sector split is obvious. With 97 notifications for tourism and 93 for healthcare<\/strong>, two of Spain's biggest industries account for the bulk of incidents. Behind them: retail (36), education (24), IT services (21), and private insurance (12).<\/p>\n This isn't coincidental. The tourism sector handles enormous volumes of personal data (passports, payment methods, travel data) often shared between multiple partners (hotels, agencies, booking platforms). Healthcare deals in ultra-sensitive data by nature \u2014 and its information systems have long been fragmented and hard to secure.<\/p>\n On the map: Madrid (135 notifications), Catalonia (114), and the Valencian Community (52)<\/strong> lead the count. The report also records 81 cross-border breaches, 53 of which involve France. In Europe, risk doesn't stop at national borders.<\/p>\n<\/div> This is the report's most striking number, by far. Of the 502 notifications filed through the AEPD's online form:<\/p>\n<\/div> 310 are classified as intentional<\/strong>, deliberate attacks<\/p>\n<\/div><\/li> 144 are accidental or unintentional<\/p>\n<\/div><\/li> 48 of unknown origin<\/p>\n<\/div><\/li><\/ul> Roughly two in three breaches are deliberate attacks<\/strong>. And by type, 462 hit data confidentiality<\/b> (compared to 98 for availability and 12 for integrity). Bottom line: these aren't technical failures \u2014 they're leaks.<\/p>\n Look at the attack methods:<\/p>\n<\/div> Ransomware \/ device encryption:<\/strong> 117 cases<\/p>\n<\/div><\/li> Data sent in error: 48<\/p>\n<\/div><\/li> Technical incident: 33<\/p>\n<\/div><\/li> Data displayed to the wrong recipient: 31<\/p>\n<\/div><\/li> Employee privilege abuse: 14<\/p>\n<\/div><\/li><\/ul> The top three methods alone (unauthorized access, phishing, ransomware) account for more than 500 incidents. What they share: an attacker gets to real data sitting in a live system<\/strong>. Which raises the question: did that data really need to be there in its real form?<\/p>\n<\/div> The AEPD's statistics record breaches affecting production systems. But they overlook a reality every CIO knows: production data is systematically copied into other environments \u2014 development, testing, QA, training, analytics.<\/p>\n These copies create real risk:<\/p>\n<\/div> They sit outside the security controls that protect production.<\/p>\n<\/div><\/li> External providers, subcontractors, and developers often have access.<\/p>\n<\/div><\/li> They get exported to the cloud, SaaS tools, and personal laptops.<\/p>\n<\/div><\/li> They expand the attack surface without adding any business value.<\/p>\n<\/div><\/li><\/ul> GDPR Article 5 lays down a minimization rule: only process data you actually need for the job. The Spanish LOPDGDD goes further: its Article 72 classifies as a very serious offense \"the deliberate reversal of an anonymization process aimed at enabling the re-identification of the data subjects\"<\/a>. That's a strong signal \u2014 and it sets a high bar: only robust, irreversible anonymization actually protects.<\/p>\n In practice, though, minimization rarely makes it outside production. A developer does not need to know a customer's real name, real address, or real card number to test a feature.<\/p>\n<\/div> One response actually works: irreversible data anonymization<\/strong>. Unlike security tools that try to block access, anonymization addresses the problem before it starts: it turns real data into fake data, still useful for the business, useless if it leaks.<\/p>\n This distinction matters: anonymized data that leaks is no longer a notifiable breach<\/strong>. Today, it's the only approach that kills the risk at the source instead of trying to contain it.<\/p>\n The AEPD itself pushes these techniques and has published several how-to guides on the subject. The Spanish regulator is one of the most advanced in Europe<\/a> here.<\/p>\n<\/div><\/div><\/div> Reduce your attack surface with DOT Anonymizer<\/p>\n<\/div> DOT Anonymizer \u2014 ARCAD Software's anonymization solution<\/a> \u2014 is built for complex, heterogeneous information systems. Environments like these are common in tourism, healthcare, banking, and insurance \u2014 precisely those highlighted by the AEPD report.<\/p>\n Here's how DOT Anonymizer addresses them:<\/p>\n<\/div> Multi-DBMS coverage:<\/strong> Oracle, SQL Server, PostgreSQL, MySQL, DB2, flat files\u2026 It works across every source \u2014 no need to rebuild your IS.<\/p>\n<\/div><\/li> Referential consistency:<\/strong> the anonymized data still works for testing, development, and analytics. The same customer keeps the same fake identity across all databases.<\/p>\n<\/div><\/li> GDPR and LOPDGDD compliance:<\/strong> the techniques line up with the AEPD's and EDPB's anonymization recommendations.<\/p>\n<\/div><\/li> Built to scale<\/strong>: rapid deployment across non-production environments, with automated refresh cycles<\/span>.<\/p>\n<\/div><\/li><\/ul> 357 million notifications. 68% intentional attacks. A sharp acceleration in 2026. The AEPD report is unambiguous: data leaks are structural, and they're growing<\/a><\/strong>.<\/p>\n Securing production isn't enough on its own. As long as real data lives in test, development, and training environments, the attack surface will stay huge. Anonymization is finally the right-sized response.<\/p>\n<\/div><\/div><\/div><\/div><\/div>1. 2026 is breaking records<\/h2><\/div>
2. Who are the victims?<\/h2><\/div>
3. Tourism and healthcare on the front line<\/h2><\/div>
4. Most concerning: 68% of breaches are intentional<\/h2><\/div>
5. Non-production data: an underestimated risk<\/h2><\/div>
6. Anonymization: the only structural response<\/h2><\/div>
7. DOT Anonymizer: a practical answer<\/h2><\/div>
8. The question is no longer \"if\", but \"when\"<\/h2><\/div>
![\"Pierre](\"https:\/\/www.arcadsoftware.fr\/dot\/wp-content\/uploads\/2026\/05\/pierre-henriet.png\")
<\/span><\/div><\/div><\/div>