European nations faced a sharp rise in distributed denial of service (DDoS) attacks in March 2025, with Spain emerging as the most targeted country, according to a new report from cybersecurity firm Group-IB.

Spain experienced an unprecedented surge, jumping from just one DDoS incident in February to 72 attacks in March—a staggering 7100% increase. The main targets included the official website of the Spanish Prime Minister’s Office, major defense and technology firm Indra, and other domestic websites.

Additionally, Group-IB reported an overall 88% increase in DDoS and hacktivism-related attacks across Europe for the month. France was hit with 30 attacks, which is 131% up from the previous month. On the other hand, Ukraine and Belgium recorded 26 and 11 attacks, respectively.

Several hacktivist groups claimed responsibility for the Spanish attacks. Mr.Hamza Group, which has been active since October 2024, has targeted the Prime Minister’s Office. TwoNet is another pro-Russian group that has claimed to have attacked Indra. Additionally, the well-known Moscow-aligned group NoName057(16) launched a campaign dubbed “OpSpain,” citing Spain’s military support for Ukraine as motivation.

The same group has also escalated DDoS activity against German entities, possibly in response to Chancellor Friedrich Merz’s proposal to supply Ukraine with Taurus cruise missiles.

Though DDoS attacks primarily disrupt access to online services and typically don’t cause long-term harm. The sheer volume and frequency of such incidents are raising concerns across the continent.

While DDoS activity surged, ransomware attacks remained relatively stable. Group-IB recorded 93 ransomware incidents across Europe in March, representing a 4% decline from February. SafePay and CI0P were identified as the most active ransomware groups during this period.

Moreover, corporate account security was also an issue, with France, Italy, and Spain reporting the highest numbers of compromised business credentials. In total, nearly 116,000 breached corporate accounts were detected across Europe—a 19% increase from the previous month.