Threat Intelligence
Suspected Russian-linked hackers disrupt Spanish factories and utilities
A series of cyberattacks in Spain have caused physical damage to factories and utilities. Police say the campaign is linked to groups sympathetic to Russia.
Ross Grant2 min read
The short version
Hackers linked to Russia are suspected of attacking factories and utilities in Spain. These cyberattacks caused real-world problems, like shutting down crematorium ovens and damaging factory equipment. Police have arrested one person and say up to 40 incidents may be connected. The attacks show that hacking can now affect physical systems, not just computers.
By the numbers
- 40attacks linked to the group in SpainBloomberg
- $100,000estimated losses from the incidentsBloomberg
What happened?
A series of cyberattacks in Spain from late 2024 to summer 2026 caused physical damage at factories, utilities and food storage sites. Spanish police arrested an Italian man in March, accusing him of aiding a group linked to the Russian government. The attacks disrupted crematoriums, factories, wineries and water facilities, causing over $100,000 in losses, according to Bloomberg.
Who is affected
According to Bloomberg (opens in a new tab), several types of organisations in Spain have been hit by these attacks. The incidents include a funeral home in Alicante, a factory in Catalonia that makes renewable-energy transformers, and two wineries. Water-pumping facilities and refrigeration units at food storage sites were also disrupted. Spanish police believe as many as 40 attacks in the country are connected.
What was taken
The main impact was not data theft but disruption to physical operations. For example, crematorium ovens stopped working, factory machinery malfunctioned and caused a fire, and heating and ventilation systems at wineries sent temperatures dangerously high. At food storage facilities, refrigeration units were affected, risking spoilage. Police estimate the losses from these incidents exceed $100,000.
How the attack worked
The specific technical details of how the attackers got in or what malware or tools they used have not been reported. The attacks caused equipment to malfunction, but it is not clear if this was through direct remote access, supply chain compromise, or other means. The Bloomberg report notes that the hackers did not always seem to understand the full consequences of their actions, suggesting a mix of intent and lack of technical control.
Who is behind it
Spanish national police arrested an Italian man living in Spain in March. He is accused of helping a group involved in the attacks. Police say the campaign is linked to the Russian government, though the report does not specify whether this is direct state action or the work of sympathetic groups. No group has publicly claimed responsibility.
The response
Spanish police have made at least one arrest and are investigating the broader campaign. The incidents have prompted concern about the vulnerability of industrial and utility systems to cyberattacks that can cause real-world damage. There is no public information yet on changes to security practices or further arrests.
Claimed vs confirmed
- Unconfirmed
The attacks are linked to the Russian government.
Spanish police say the campaign is linked to Russia, but the report does not specify direct state involvement.
Why it matters
The attacks highlight that cyber incidents can now cause physical damage, not just steal data. Critical infrastructure like factories and utilities are at risk from hackers, even if they are not obvious targets. This raises concerns about the security of systems that control real-world processes.
Key points
- Hackers sympathetic to Russia targeted Spanish factories and utilities.
- Physical damage included fires, equipment shutdowns, and spoiled goods.
- Police arrested an Italian man accused of aiding the group.
- Losses from the attacks exceeded $100,000.
- The attacks show cyber incidents can have real-world, physical effects.
Sources
Bloomberg
Reference
