Business Climate Survey. Section on the Current Entrepreneurial Situation. Q2/2025

In the second quarter of 2025, 35.0% of businesses in Catalonia declared that they were cyberattacked: 10.3% during last year and 24.7% more than 12 months ago.

By activity sector, industry was the sector with the highest percentage of businesses being cyberattacked (47.7%), followed by construction (32.8%) and other services (32.7%). In terms of business size, those with 50 employees and over were the most affected by cyberattacks (47.1%), while those with less than 10 employees were the least affected (22.0% had suffered some).

A total of 52.8% of businesses in Catalonia that were cyberattacked declared that they could not identify the entry point, and 43.2% reported the attack to the competent authorities.

The main consequences of the last cyberattack in businesses were the unavailability of ICT services (28.8%), data destruction or corruption (25.3%), and financial fraud (18.6%).

A total of 96.0% of businesses in Catalonia declared that they apply cybersecurity measures. Of these, 95.6% back up data to a separate location (including cloud storage); 82.4% keep software updated to address security vulnerabilities; and 73.1% use digital certificates for email signing or encryption.

On the other hand, 69.3% of the businesses in Catalonia employ cybersecurity specialists, and 40.5% are insured against cybersecurity incidents.

Regarding the knowledge of cybersecurity obligations, businesses declared that employees access the information mostly through voluntary training or through information available internally (56.7%).