Ransomware Hackers Target Spanish City Services, Seeking Bitcoin Payment

A sophisticated ransomware campaign has crippled the municipal infrastructure of Sanxenxo, a coastal city in Spain’s Galicia region. According to cybersecurity reports covered by ChainCatcher, the cyberattack encrypted thousands of administrative files and rendered city government systems inaccessible as of late January 2026. The incident has caused significant disruptions to essential services for the city’s 17,000-plus residents, marking a critical infrastructure breach in the region.

Encryption Paralyzes Municipal Operations in Spanish Region

The attack fully disabled municipal servers, creating a complete operational blackout for the city administration. Government offices were unable to access vital records and systems required for routine public services. Sanxenxo’s leadership immediately escalated the situation, reporting the incident to the Spanish Civil Guard and local authorities to investigate the breach and identify those responsible for the attack.

Bitcoin Ransom Demand: Hackers Seek $5,000 in Cryptocurrency

The cyber criminals behind the attack are seeking $5,000 in Bitcoin from city officials to restore encrypted files and system access. Despite the pressure and disruption caused by the ransomware, Sanxenxo’s city government has firmly rejected the ransom demand. This decision reflects a growing trend among municipalities in Spain and Europe to resist payment demands that could fund future criminal operations.

Data Recovery Strategy: Sanxenxo Implements Backup and Restoration Protocol

Rather than capitulating to extortion, the city administration has initiated a comprehensive recovery strategy using daily backup systems. This approach allows the city to gradually restore critical data and rebuild operational capacity without transferring funds to criminals. The measured response demonstrates Sanxenxo’s commitment to cybersecurity resilience and protecting residents’ interests, setting an example for other municipalities facing similar threats in the Spanish region and beyond.