Cybersecurity for SMEs in the Canary Islands: 5 Real Threats and How to Protect Yourself

Phishing is the most common entry point for attacks on SMEs. The attacker sends an email impersonating a trusted organisation — a bank, a regular supplier, the Spanish Tax Agency — to trick the recipient into clicking a malicious link, downloading an infected file or handing over their credentials.

A particularly damaging variant for businesses is BEC (Business Email Compromise): the attacker poses as a supplier or a senior manager of the company itself to request an urgent bank transfer. In a recent case in Las Palmas de Gran Canaria, a distribution company received an email from a "regular supplier" announcing a change of bank account number. It came from an address almost identical to the real supplier's, with the same name and signature. The €12,400 transfer was made before the fraud was spotted.

Protective measures

Ransomware encrypts every file on the infected system and demands a ransom (usually in cryptocurrency) in exchange for the decryption key. It is the attack with the greatest financial impact on SMEs — not only because of the ransom itself (which rarely guarantees recovery), but because of the days or weeks of operational paralysis it causes.

In 2024 a hotel in the south of Tenerife suffered a ransomware attack that encrypted the main server running its PMS, accounts and administrative documents. The business operated on paper for three days, with manual check-ins and no access to existing bookings. The direct cost — the ransom (which they paid), system recovery and lost revenue — exceeded €85,000. The way in was a Windows Server 2016 machine with RDP exposed to the internet and no updates since 2022.

Protective measures

POS systems are an attractive target because they process card data in real time. The most common attacks involve planting malware that captures card details at the moment of payment (software skimming), or exploiting vulnerabilities in older POS systems connected to the same network as the rest of the business.

In the Canary Islands, hospitality and retail account for a high share of card transactions, particularly from international tourists. A compromised POS terminal can create significant legal liability under the PCI DSS standard, on top of the reputational damage of exposing customers' payment data.

The most common mistake we see in audits is the POS sharing a Wi-Fi network with office laptops, staff mobile phones and, in some cases, even the hotel's guest network. Any device on that network is a potential route into the POS.

Protective measures

The General Data Protection Regulation (GDPR) and its Spanish implementing law, the LOPDGDD, set out clear obligations on how businesses must handle their customers' personal data. Non-compliance not only risks penalties from the AEPD (the Spanish Data Protection Agency), but also loss of customer trust and reputational damage that is hard to quantify.

For Canary Islands tourism businesses the risk is especially high: hotels, holiday apartments and travel agencies process data on citizens from across the European Union, including sensitive information such as passport details, card numbers and stay history. A security breach in a guest database can lead to fines of up to 4% of global annual turnover.

The cases we see most often in audits: customer databases reachable from the intranet without a password, backups containing unencrypted personal data stored in cloud services with no access controls configured, and web applications with SQL injection vulnerabilities that expose the entire database.

Protective measures

The rise of remote working during the pandemic led many SMEs to open up remote access to their systems quickly and without proper security. Two years on, many of those connections are still live, sometimes with credentials that have never been changed, unpatched software and no multi-factor authentication.

Windows RDP (Remote Desktop Protocol) exposed directly to the internet without MFA is one of the entry points most exploited by ransomware groups. Attackers use automated tools that scan entire IP ranges for open RDP ports (3389 by default) and launch brute-force attacks on the credentials. With weak or reused passwords, they are in within minutes.

In audits of Canary Islands SMEs we have found live RDP access to production servers that had been open since 2020, with administrator passwords unchanged since installation. In several cases those servers had already been compromised and were part of botnets without the business knowing.

Protective measures