Catalonia invests 18 million to combat cyberattacks amid AI and quantum computing threats

The traditional image of a hacker breaking into systems manually is fading as cybercriminals increasingly use Artificial Intelligence (AI) to conduct faster and more effective cyberattacks. Facing this challenge, Catalonia is stepping up its digital security efforts to take a significant leap forward. The looming threat from AI is compounded by the future risk posed by quantum computers, which, although still in early development, could soon easily breach existing security systems.

To counter these threats, the Catalan government is increasing its digital defenses to protect millions of sensitive data records, particularly in healthcare, where data commands high prices on the black market, and also in the financial sector.

Albert Dalmau, Catalonia’s Minister of the Presidency, announced a historic investment of 18.6 million euros from Next Generation funds to strengthen the protection of citizens, municipalities, and critical public services such as hospitals. The Cybersecurity Agency of Catalonia has outlined 27 specific actions to be implemented by June 2026. A new strategic plan for 2025 will also be launched, supported by the largest cybersecurity investment to date.

Dalmau emphasized the increasing complexity and hybrid nature of cyberattacks, stressing the need to bolster Generalitat’s defenses, particularly against future quantum computing threats. Although these threats are anticipated in the future, Catalonia is already experimenting to prepare effective responses for when quantum cyberattacks become a present-day issue.

The Barcelona Supercomputing Center is advancing quantum technology efforts to make Catalonia one of Europe’s leaders in this field. This center will develop quantum encryption methods independently of external entities, helping prevent attacks that utilize quantum technology.

According to the Cybersecurity Agency, current systems are holding up against sophisticated attacks. In 2024, the Generalitat faced 3,372 cyber incidents, a 26% increase from the previous year, most of which were minor. The agency credits improved prevention measures for avoiding serious breaches.

The agency recorded over 6.9 billion attempted cyberattacks targeting public administration information systems, healthcare centers, and universities in Catalonia during the same year, although none were successful. Laura Caballero, agency director, stated that while zero risk is impossible, they are committed to minimizing damage by setting maximum security barriers. The 27 actions are organized into seven focus areas, managed by a dedicated technical office.

Protecting healthcare data is a top priority. In 2024, 1.257 billion cyberattacks were recorded against medical centers, none causing major damage. Lessons learned from incidents like the one at Hospital Clínic of Barcelona have improved preventive strategies. Planned measures include enhancing cybersecurity in 68 hospitals, 21 primary care centers, 49 social healthcare centers, and 44 mental health facilities.

Another key area involves assessing the cybersecurity status of 400 critical digital systems, including tax agencies, health portals, police applications, and domestic violence information systems, as attacks here would greatly impact citizens.

Catalonia also aims to improve cybersecurity at the local government level by evaluating risk in municipalities with over 50,000 inhabitants, four provincial councils, and 40 regional councils. Collaborating with Localret, the government will develop security plans and training to raise awareness among these local entities.

Finally, the plan includes initiatives to increase public awareness against digital scams and data breaches. The agency is working to democratize cybersecurity access and empower citizens to protect themselves using tools like a WhatsApp channel with 12,000 subscribers for scam prevention, AI-based assistance for advice, and systems to identify malicious emails and SMS. However, tackling malicious phone calls remains difficult due to dependency on telecom operators.