Barcelona under attack: what the recent cyberattacks on the City Council mean and how companies can protect themselves

An alarming increase in security events in the midst of the digital age

In the first five months of 2025, Barcelona City Council has registered more than 25,000 digital security events, equaling the total recorded for the entire year 2024. Among them, 144 attacks managed to overcome the defenses, and 33 generated significant impacts in municipal systems (La Vanguardia, 2025).

This scenario is no exception, but a indicator of the increasing pressure faced by public and private institutions in the area of cybersecurity.

‍

What is happening in Barcelona?

The City Council has been the target of:

• Targeted phishing attacks, who attempt to compromise the credentials of municipal employees.
• Denial of Service (DDoS) attacks that seek to saturate and paralyze online services.
• Intrusions that overcome defensive barriers, although without affecting citizen services for now.

The CISO of the council, David Esteban, has assured that”Targeted attacks we will always have”, and that protective measures have been reinforced with:

• Multifactor Authentication (MFA)
• Regular operational recovery drills
• Ongoing evaluations of digital infrastructure

‍

Barcelona is not alone: collaboration and joint strategy

The City Council has begun to collaborate closely with other cities such as Madrid, Malaga and Rome, seeking to create a coordinated intermunicipal defense model. In addition, it is developing a new SOC (Security Operations Center) and a Cybersecurity Master Plan to improve response capacity to complex threats

‍

Risks for private companies: What the public sector is teaching us

Recent incidents in Barcelona show that:

1. The sophistication of digital attacks is on the rise, even in institutions with resources.
2. Exposure to threats does not distinguish between public and private.
3. Companies must learn from these experiences and reinforce their own strategies of defense.

Ignoring these signals can leave organizations vulnerable to similar attacks.

‍

Recommendations: How to prepare for similar scenarios

Key measures to strengthen your company's cyber resilience:

• Implement a 24/7 threat monitoring system.
• Establishes clear internal protocols for incident management.
• Reinforce the culture of cybersecurity among your teams.
• Bet on external collaboration with cybersecurity experts.

‍

Conclusion: Being prepared is the best defense

Cyber attacks on Barcelona City Council are not only a warning to public administrations, but also a direct wake-up call to companies. The sooner action is taken, the less impact will be in the face of future incidents.

‍

Act now!

At Apolo Cybersecurity we help public and private organizations to strengthen your digital infrastructure, prevent attacks and improve operational resilience. Schedule one free consultation now!

‍