Article 264 Spanish Criminal Code: Computer Damage and Sabotage (2026)

Article 264 of the Spanish Criminal Code punishes computer damage: deleting, damaging, deteriorating, altering, suppressing or rendering inaccessible another person's computer data, programs or electronic documents, without authorisation and in a serious manner. Together with articles 264 bis, 264 ter and 264 quater, it forms the Spanish framework against computer sabotage: attacks on the operation of systems, the tools used to carry them out and the criminal liability of companies. As criminal defence lawyers specialised in cybercrime, we explain what each provision actually punishes, the penalties involved and where the defence arguments lie.

What Article 264 Says: the Basic Offence

Article 264.1 CP imposes 6 months to 3 years in prison on anyone who, by any means, without authorisation and in a serious manner, deletes, damages, deteriorates, alters, suppresses or renders inaccessible another person's computer data, computer programs or electronic documents, where the result produced is serious.

Three elements of the offence stand out:

• Subject matter: data, programs and electronic documents belonging to another. What the law protects is the integrity of information; physically destroying someone else's computer or server is prosecuted as ordinary criminal damage under article 263 CP.
• Lack of authorisation: anyone acting with the system owner's permission — for instance in a contracted security audit — falls outside the offence.
• A double seriousness test: both the conduct and the result must be serious. Unlike ordinary criminal damage, there is no 400-euro threshold separating a minor offence: incidents that fail this double test are simply not criminal under article 264.

Paragraph 3 adds a cross-cutting aggravation: the penalties are imposed in their upper half where the offender unlawfully used another person's personal data to gain access to the system or to win a third party's trust.

The Aggravated Forms of Article 264.2

The penalty rises to 2 to 5 years in prison plus a fine of one to ten times the loss caused where any of these five circumstances applies:

1. The offence was committed within a criminal organisation.
2. It caused especially serious damage or affected a high number of computer systems — the typical aggravation in large-scale malware campaigns.
3. It seriously disrupted essential public services or the supply of staple goods.
4. It affected the computer system of critical infrastructure or created a serious danger for the security of Spain, the European Union or a Member State.
5. It was committed using the tools described in article 264 ter: attack software, or another person's passwords or access codes.

In cases of extreme seriousness, the court may additionally impose the penalty one degree higher.

Article 264 bis: Hindering or Interrupting a System

Article 264 bis CP protects not the data itself but the operation of the system. It punishes with 6 months to 3 years in prison anyone who, without authorisation and in a serious manner, hinders or interrupts the operation of another's computer system in one of three ways: by carrying out the conduct of article 264, by introducing or transmitting data — the natural fit for denial-of-service attacks — or by destroying, damaging, disabling, removing or replacing the computer, telematic or electronic storage system itself.

The provision contains two aggravated tiers:

• If the attack significantly disrupts the normal activity of a company, business or public administration, the penalty is imposed in its upper half and may be raised to the next degree.
• If any of the circumstances of article 264.2 applies, the penalty is 3 to 8 years in prison plus a fine of three to ten times the loss.

Here too, the upper half applies where another person's personal data was unlawfully used to access the system or to win a third party's trust.

Article 264 ter: Attack Software, Passwords and Access Codes

Article 264 ter CP moves criminal liability forward to preparatory acts. It punishes with 6 months to 2 years in prison or a fine of 3 to 18 months anyone who, without due authorisation, produces, acquires for use, imports or supplies to third parties, with the intention of facilitating the offences of articles 264 and 264 bis:

• A computer program designed or adapted mainly to commit those offences.
• A computer password, access code or similar data allowing access to all or part of an information system.

The decisive element for the defence is intent: the offence requires the specific purpose of facilitating computer damage or sabotage. Dual-use tools — vulnerability scanners, penetration-testing suites — handled in authorised professional cybersecurity work fall outside the provision. The boundary with unlawful access to systems under article 197 bis CP also matters: accessing without damaging is a different offence with a different penalty.

Article 264 quater: Corporate Criminal Liability

Computer damage and sabotage trigger corporate criminal liability under article 31 bis CP. Article 264 quater sets the penalties for legal entities:

• A fine of 2 to 5 years, or five to twelve times the value of the loss caused if that amount is higher, where the offence committed carries more than 3 years' imprisonment.
• A fine of 1 to 3 years, or three to eight times the loss if higher, in all other cases.

Courts may also impose, under article 66 bis, the penalties of letters b) to g) of article 33.7 CP: suspension of activities, closure of premises or disqualification from public subsidies, among others. An effective criminal compliance programme, implemented before the offence, can exempt the company from liability or mitigate it.

Ransomware: Computer Damage plus Extortion

Ransomware is the textbook example of overlapping offences. By encrypting the victim's files, the attacker renders them inaccessible — the conduct of article 264 — and usually hinders or paralyses the entire system (article 264 bis). Demanding a ransom to restore them adds extortion under article 243 CP: forcing another person, through intimidation and with intent to profit, to perform an act to the detriment of their assets, punished with 1 to 5 years in prison.

The list can grow: prior unlawful access to the system (article 197 bis CP), the aggravation for unlawful use of another person's personal data (articles 264.3 and 264 bis.3) and, where information is exfiltrated under threat of publication, the offences of discovery and disclosure of secrets under article 197 CP. We act both for companies and individuals targeted by these attacks and for people under investigation for them: full details on our ransomware criminal defence page.

If you have been attacked, proceed methodically: do not pay without legal advice, preserve the affected systems and the evidence, and report the incident. Our legal guide on what to do if you have been hacked walks you through the steps under Spanish law.

Defence Strategies

1. Lack of seriousness: the double test of article 264.1 — serious conduct and a serious result — keeps minor incidents outside the offence; challenging the real scale of the damage is the first line of defence.
2. Existing authorisation: system administrators, employees with credentials and IT contractors often operate in grey areas of permission; where authorisation existed, there is no article 264 offence.
3. Attribution and technical evidence: an IP address alone does not identify a person. The defence must scrutinise the forensic expert report, the chain of custody of the logs and how the digital evidence was obtained.
4. Absence of intent: article 264 has no negligent form; an accidental deletion or a careless maintenance failure is not computer damage.
5. Quantifying the loss: the amount drives the proportional fine and the aggravated forms; a counter-expert report can substantially reduce the penalty.
6. Repairing the harm: compensating the victim or helping restore the systems triggers the mitigating factor of article 21.5 CP and strengthens the position in any plea negotiation.