The Spanish Agency for Data Protection (AEPD) has reported that during the first half of 2026, 3,027 personal data breaches have been communicated by data controllers. This figure contrasts with the 1,271 reported in the same period of the previous year and represents an increase of 138%.
According to the Agency itself, detailed this Tuesday, between the months of January and August, it has recorded 4,556 notifications, well above the 1,728 received in that interval of 2025, which implies an increase of 163%.
In this way, the personal data breaches notified to the AEPD in the first six months of 2026 already exceed the total recorded throughout 2025, a year in which 2,765 communications were reached.
In this scenario, the Agency explained that in March it identified that an incident occurring in a single data processor resulted in a personal data breach that simultaneously affected multiple controllers.
Furthermore, the report corresponding to the month of July indicates that notifications related to hotel establishments and their data processors, mostly reservation management software providers, have had a significant weight in the strong increase of communications sent to the AEPD in the previous months.
"In many of these breaches, unauthorized third parties access personal data of clients and information about their reservations, which can later be used to attempt fraud," it emphasized.
On the other hand, the AEPD has pointed out that ransomware attacks continue to cause personal data breaches in organizations from very diverse sectors, potentially affecting both the availability and confidentiality of information.
In this regard, the agency has reiterated the "need for controllers and processors to have appropriate preventive measures according to the level of risk and procedures that allow them to act in the event of a breach to minimize its possible consequences."
The Agency has also added that the controllers who communicated a personal data breach to the AEPD issued more than 71 million communications to the affected parties in the first half of 2026, as a high risk for their rights and freedoms was perceived.