Ransomware threat cripples management systems in Sanxenxo

The Galician city of Sanxenxo in Northwest Spain was shaken in early February by a massive ransomware attack that blocked key administrative functions. With over 17,000 residents, the city is now forced to rethink its digital infrastructure and strengthen its cybersecurity measures. The incident highlights the growing vulnerability of local authorities to modern digital threats.

Digital Extortion Hits City Infrastructure

The cyberattack targeted the city government specifically and encrypted thousands of administrative documents. According to the security intelligence agency ChainCatcher, the attackers also blocked access to core systems, leading to a widespread failure of municipal servers. Public services were severely disrupted, and many everyday administrative processes came to a halt.

Cybercriminals Demand Ransom in Bitcoin

The perpetrators made the classic extortion demand: $5,000 in Bitcoin to restore access. The specific demand for cryptocurrency underscores the professionalization of modern ransomware operations. However, the city of Sanxenxo categorically refused to pay – an important signal against funding cybercriminals.

Official Response and Recovery Strategy

Following the incident, the city government immediately involved the Spanish Guardia Civil. Instead of succumbing to the ransom demand, authorities rely on professional recovery methods: daily backup processes allow them to gradually reconstruct the systems. This strategy demonstrates both technical competence and a refusal to be extorted by ransomware actors. The data-driven approach could serve as a model for other cities in responding appropriately to ransomware incidents.