Ransomware accounts for 83.5% of intrusions attributed to cybercriminals in the EU, according to a study by the European Parliament. SMEs are the primary target: in Germany, 80% of attacks in 2025 affected them.
The ransomware is the main threat to SMEs. A report from the European Parliament estimates that 83.5% of intrusions attributed to cybercriminals in the EU used this type of malicious software. Furthermore, in Germany, 80% of cyberattacks in 2025 targeted small and medium-sized enterprises, according to a report from the Federal Office for Information Security of that country. The information, published by emprendedores.es, includes recommendations from Panda Security for prevention and response to an incident.
The cybersecurity company insists that preparation makes the difference. The first step is to ask whether the company could continue operating if it lost access to all its systems and data today. The usual answer is no. "An SME needs to know which systems are essential to maintain its activity, what would happen if it were to lose them for a few hours or several days, and how long it would actually take to recover them," points out Hervé Lambert, Global Consumer Operation manager at Panda Security.
To prevent an attack, Panda Security recommends six specific measures. The first is to identify critical systems and the order of recovery. The second is to maintain redundant backups, with at least one out of reach of the usual systems, and to periodically test their restoration. The third is to activate multi-factor authentication on all access points. The fourth is to segment the network to limit the attacker's progress. The fifth is to systematically update software. And the sixth is to inventory all devices and applications connected to the organization.
In the event of an attack, the protocol includes seven steps. The first is to disconnect the affected equipment from the network. Next, assess the true extent of the intrusion. Then, contact INCIBE through its support channels. The fourth step is to comply with legal notification obligations, which may include the Spanish Data Protection Agency if personal data has been compromised. The fifth decision is whether to pay the ransom or not, an option that Panda Security advises against as it does not guarantee recovery. The sixth step is to conduct a forensic analysis to understand how access was gained. And the seventh is to review and update the response plan with the lessons learned.
The impact of a single attack can be lethal. According to a study by Vodafone in Ireland, 28% of SMEs risk closing after suffering a single ransomware incident. Although there are no equivalent data for Spain, experts believe the situation would not be very different.
"A backup is valuable when we know we can recover it and understand how long it will take to do so. For a small business, there can be a huge difference between recovering its information in a few hours, doing so in several days, or discovering during the incident that some of the data it expected to recover is unavailable," warns Lambert.
INCIBE offers free assistance to SMEs and freelancers through its help line 017, available 24/7. Additionally, the public entity provides guides and self-diagnostic tools on its website to assess the company's cybersecurity level.
You may also like
