What to Do If You Have Been Hacked in Spain: Complete Legal Guide (2026)

Discovering that someone has accessed your email, social media, bank account or phone without permission is a distressing experience. What many do not know is that hacking is a criminal offence in Spain, punishable by up to 2 years in prison (Art. 197 bis CP). As criminal lawyers specialising in cyber offences, we explain exactly what to do.

The 7 Immediate Steps If You Have Been Hacked

1. Do not touch anything: do not delete messages, emails or history. Everything can be evidence. If the hacker left a message, capture it.
2. Screenshots: take screenshots of everything unusual — unrecognised logins, messages you did not write, password changes, connected devices.
3. Change passwords: from a secure device (NOT the compromised one), change the password of the hacked service and enable two-factor authentication (2FA).
4. Review access: check the recent logins in the security settings of the affected service. Note the suspicious IPs and locations.
5. Unlink devices: log out of all devices. Revoke third-party app access.
6. Report it to the police: you can report online or in person. If the hack is serious (banking access, blackmail), contact the Technology Investigation Unit directly.
7. Contact a criminal lawyer: a complaint properly directed by a lawyer triggers more effective police investigations and can claim damages as a private prosecutor.

Which Offences Does the Hacker Commit?

• Unlawful access to systems (Art. 197 bis CP): accessing a computer system without authorisation. Penalty: 6 months to 2 years in prison.
• Disclosure of secrets (Art. 197 CP): if the hacker accesses emails, intimate photos or private documents. Penalty: 1 to 4 years.
• Computer damage (Art. 264 CP): if data is deleted or the system disabled. Penalty: 6 months to 3 years.
• Computer fraud (Art. 249 CP): if the access is used to transfer money or impersonate you.
• Extortion (Art. 243 CP): if you are blackmailed with publishing the information obtained.

How to Preserve Digital Evidence

Digital evidence is volatile. For it to be admissible at trial: do not handle the compromised device until an expert analyses it; obtain a notarial record of the web content; have a forensic IT expert make a certified copy (a forensic image) with a SHA-256 hash; and have your lawyer request the judicial preservation of the provider's access logs before they are deleted (providers keep them for 30 to 90 days).

Can I Claim Damages From the Hacker?

Yes. As a private prosecutor, you can claim asset damages (money taken, recovery costs, expert reports), moral harm (courts recognise compensation of 3,000 to 30,000 euros for intrusion into privacy) and loss of earnings if the hack affected your business.

Has Your Company Been Hacked?

If the hack affects client or employee data, the company has additional obligations: notification to the data protection authority within a maximum of 72 hours of detecting the breach (Art. 33 GDPR), notification to those affected if the breach poses a high risk, a criminal complaint, and activation of the cyber-insurance policy.

Frequently Asked Questions

Can I report it if I do not know who hacked me? Yes. A complaint is filed against an unknown person. The cyber unit will investigate the IP and digital traces to identify the author.

Can the hacker go to prison? Yes. Basic unlawful access carries up to 2 years; if secrets are discovered, up to 4 years; if damage is caused, up to 3 years.

And if the hacker is in another country? Spain has judicial cooperation agreements (the Budapest Convention) and can request assistance through Europol and Eurojust.