Criminal Lawyers in Ransomware & Damages Defense

The ransomware and computer-damage offences, regulated in Arts. 264 to 264 quater of the Spanish Criminal Code, protect the integrity and availability of computer systems and data. After the reform operated by Organic Law 1/2015 in compliance with Directive 2013/40/EU on attacks against information systems, the Criminal Code articulates a gradual system: Art. 264 CP sanctions damage to computer data; Art. 264 bis CP, damage to the operation of computer systems (including denial-of-service attacks); Art. 264 ter CP, the production, acquisition or facilitation of attack tools; and Art. 264 quater CP, the criminal liability of the legal entity. Consolidated case-law has precisified the contours of the type, especially in double-extortion cases (encryption + threat of publication) and forensic attribution. As criminal lawyers specialising in cybercrime, we articulate defence with certified forensic computer expertise.

The typical modalities cover an increasingly sophisticated catalogue. Classic ransomware: massive file encryption through malware (LockBit, BlackCat, REvil, Conti) and ransom demand in cryptocurrencies to deliver the decryption key. Double-extortion ransomware: in addition to encryption, prior exfiltration of sensitive data and threat of publication on the dark web. Triple extortion: incorporating DDoS attacks against the victim's public domain and coercive notification to their customers. DDoS attacks (distributed denial of service) deployed from botnets composed of thousands of infected zombie devices. Cryptojacking: clandestine cryptocurrency mining using victim resources. Wiping: destructive data erasure without economic intent (frequently linked to hacktivism or geopolitical conflicts). And the distribution of wipers or logic bombs inserted in source code or software updates.

The penalties are severe due to the usual real concurrence. The basic type under Art. 264.1 CP (damage to computer data) sanctions with prison from 6 months to 3 years. When specific aggravating factors concur (Art. 264.2 CP: acts of special severity, systematic or lucrative conduct, harm to critical infrastructures), penalties rise to 2-5 years' prison; and, in extraordinary cases, to 6 years. Art. 264 bis CP (damage to system operation) has an analogous regime. The concurrence with extortion (Art. 243 CP) in ransomware cases adds 1-5 years' prison. Double extortion further activates the types of Art. 197 CP (revelation of secrets), with prison up to 5 years. For companies, Art. 264 quater CP provides criminal liability of the legal entity with fines exceeding one million euros, complemented by GDPR administrative liability with fines up to EUR 20 million or 4% of annual global turnover.

The technical defence articulates several complementary lines. First, the alternative forensic attribution: in DDoS or ransomware investigations, the client's IP may appear in logs without implying material authorship; technical expertise certifies that the device was infected, part of a botnet (Mirai, Mozi) or impersonated by IP spoofing, neutralising the charge. Second, the absence of intent: the client was unaware of the unlawful nature of the tool used, or believed they were carrying out authorised pentesting. Third, the challenge to the digital chain of custody: many police reports lack cryptographic hash, time-stamping and adequate forensic traceability of logs, ransom messages and malware samples, opening avenues of evidentiary nullity. Fourth, when representing the corporate victim, we articulate the GDPR notification to the AEPD within 72 hours, the cyber-insurance claim, negotiation management with the attackers (without recommending ransom payment as a general rule) and coordinated civil and criminal procedural articulation.

In current forensic practice we observe exponential growth in ransomware and computer-damage proceedings, especially linked to attacks against hospitals, city councils and universities, critical energy and transport infrastructures, SMEs with low cyber hygiene, and supply chains (SolarWinds, Kaseya-type supply-chain attacks). Directive NIS2 (EU 2022/2555) on cybersecurity, Regulation DORA EU 2022/2554 on financial-sector digital operational resilience, Regulation RCE EU 2022/2557 on critical-entity resilience, the Cyber Resilience Act EU 2024/2847 on digital devices, Organic Law 1/2025 on Justice Service Efficiency and the EU GDPR 2016/679 have transformed the regulatory framework. At Alonso Sala, we tackle each file with a multidisciplinary criminal-administrative-cybersecurity team: certified forensic experts (CISSP, GCFA, OSCP), coordinated management with INCIBE and the AEPD, urgent procedural articulation and, where appropriate, discreet negotiation with the incident actors.