The growing dependence on technology has turned airports, hospitals, power grids and communications systems into possible targets of the so-called hybrid threats, a type of operation that combines digital tools, physical actions and disinformation techniques to weaken the functioning of a country. Unlike a conventional military attack, these operations can be carried out without armed confrontations and without it being easy to identify those responsible, which makes both the response of the authorities and the attribution of responsibilities more difficult.
The European Union defines hybrid threats as coordinated hostile activities that seek to harm a State, an institution or a society through different instruments used jointly. These include cyberattacks, sabotage of critical infrastructure, information manipulation, economic pressure and interference with navigation systems. They can be promoted by state actors or non-state groups and are often designed to remain below the threshold of an open armed conflict. Their purpose is not always to destroy an installation: it can also be to generate uncertainty, disrupt everyday services, cause economic losses or erode citizens’ trust in institutions.
European concern has increased in recent years. In March 2026, the EU Council approved new conclusions to strengthen the capacity of the Member States against these threats, while the European Parliament adopted a resolution in September on the protection of critical infrastructure in the face of hybrid operations. The debate coincides with a scenario of growing malicious activity in the digital environment. According to the 2026 threat report of the European Union Agency for Cybersecurity (ENISA), transport accounted for 8% of the incidents examined, while public administrations were the sector most affected, at 32%.
Airports: interference with GPS, blocked systems and suspended flights
One of the sectors especially exposed is air transport, whose activity depends on a broad communications network, radars, navigation systems, flight management platforms, and digital services. An attack against any of these elements can cause delays, cancellations, or restrictions on operations, even if no physical damage occurs to the aircraft. Cybercriminals can also target companies that provide services to airports, such as billing providers, baggage handling, or information technologies, generating disruptions that affect multiple facilities at the same time.
Among the techniques that most concern aviation authorities are jamming and spoofing, two forms of interference with satellite navigation signals. The first consists of making it difficult or blocking the reception of those signals, while the second uses false signals to cause the equipment to receive incorrect information about its position or the time. The European Union Aviation Safety Agency (EASA) updated in July 2026 its safety recommendations in the face of the increase in these incidents, especially in regions near conflict zones.
These interferences can force flight crews to use alternative navigation systems and, in certain circumstances, modify routes or divert flights. They do not mean that aircraft automatically lose control, since aviation has backup procedures and equipment. However, they can increase the workload of pilots and air traffic controllers and temporarily reduce the operational capacity of certain routes. A hybrid operation could combine technological interference with the dissemination of false information to amplify the alarm among travelers, although it would be necessary to demonstrate that coordination to talk about a campaign of this kind.
Hospitals: postponed operations and loss of access to medical data
Hospitals represent another especially sensitive target because their computer systems are directly related to healthcare. Digital medical records, laboratory results, ambulance management, medical appointments, and numerous devices depend on networks and applications that must be kept available. If a healthcare organization temporarily loses access to those tools, it may be forced to resort to manual procedures, reorganize appointments, or postpone certain interventions.
One of the most common threats is ransomware, a type of malicious program that blocks systems or encrypts files in order to later demand a financial ransom. ENISA has documented incidents of this type in European hospitals that led to the postponement of medical procedures. In addition, the theft of health data can compromise especially sensitive information about patients and generate new consequences even after the systems are restored.
Nevertheless, a ransomware attack against a hospital does not necessarily constitute a hybrid operation. It may be economic crime without political or strategic objectives. The hybrid component would appear if there were evidence that the attack forms part of a coordinated action intended to destabilize healthcare services, for example, by combining it with sabotage in other infrastructures or deliberate campaigns to spread false information about medical care. In this scenario, the objective could be both to disrupt the operation of the hospital and to increase the population’s distrust in the authorities’ capacity to respond.
Communications: the risk of undersea cables and telephone networks
Telecommunications networks constitute another strategic infrastructure because they support much of economic activity and public services. A major disruption to connectivity can affect telephone calls, internet connections, electronic payments, and emergency coordination systems, although its scope will depend on the duration of the incident and the alternative connections available. Attacks can target computer equipment and data centers, but also physical elements of the networks, such as fiber optic facilities or undersea cables.
The European Commission estimates that undersea cables carry around 99% of internet’s intercontinental traffic, which explains their importance for security and the economy. After several incidents recorded in recent years, Brussels has driven specific measures to strengthen their protection and improve repair capability. In February 2026, it presented new tools to assess risks, detect vulnerabilities, and respond to possible damage to these infrastructures.
The difficulty lies in determining the origin of each incident. A cut cable does not, by itself, prove that there is sabotage, since it may also be due to maritime activities, human error, or natural phenomena. To attribute it to a hybrid operation, it is necessary to examine technical evidence, the possible intentionality, and its relationship to other actions. Precisely that ambiguity is one of the characteristics of these threats: those responsible may try to make a deliberate act appear like an accident and thereby hinder a coordinated response.
How Spain is protected and when it can be said that there is a hybrid attack
Responding to these threats requires the participation of different security bodies, administrations, and private operators. In Spain, the National Cryptologic Center (CCN), the National Institute of Cybersecurity (INCIBE), and the bodies responsible for the protection of critical infrastructures perform functions related to prevention, detection, and response to incidents within their respective areas. At the European level, the directive NIS2 sets out a reinforced cybersecurity framework for essential sectors such as energy, transport, healthcare, and telecommunications, with risk-management obligations and incident reporting for entities included in its scope.
Protection does not depend only on preventing attacks. It is also essential to maintain backup systems, have continuity plans, conduct drills, and ensure that essential services can continue to operate during a technological disruption. In airports, this means having alternative navigation and management procedures; in hospitals, ensuring mechanisms to continue treating patients; and in communications, strengthening redundant routes and the resilience of networks.
The main caution is to distinguish between a technical failure, an isolated cyberattack, and an organized hybrid operation. A breakdown of an airport’s computer systems, a telecommunications malfunction, or a hospital disruption do not automatically allow concluding that there is coordinated hostile action. To establish that connection, it is necessary to investigate the origin of the incident, identify possible evidence of intent, and determine whether it is part of a broader campaign.
Therefore, the increase in hybrid threats does not mean that all technological problems are the result of sabotage. The authorities’ concern lies in the possibility that several seemingly independent attacks form part of the same destabilization strategy, taking advantage of the dependence on infrastructures that prove essential for everyday life.