Author
Ciberseguridad720
Editorial Team
Spanish businesses are facing a mess of industrial proportions that is putting the survival of thousands of companies at risk. This is not a consultant exaggerating to make a sale: the data from Spain's National Cybersecurity Institute (INCIBE) is a punch of reality. In 2024 more than 97,000 incidents were handled, a figure that already looked like a collective security failure, but in 2025 it jumped to 122,223 cases, an increase of 25% in just one year. This growth is no coincidence; it is the result of the extreme professionalisation of cybercrime, which has put Spanish SMEs in its sights, taking advantage of the fact that many are stretched thin by day-to-day management and neglect the most basic thing: the key to their digital house.
The situation is especially painful on social media. What used to be a simple hack to post nonsense on a wall is now a financial hijacking operation. Facebook accounts are not stolen for the fun of it, but to take control of Meta Business Suite and bleed the credit cards linked to advertising. For a small company that depends on its ads to win clients, losing access to its business account means entering a spiral that, in 60% of cases, ends with the business closing for good within six months. In this report we analyse how the bad guys are hitting the mark with their attacks and which mistakes we are making that make it so profitable for them.
Spain has established itself as the third most attacked country in the world, a bronze medal nobody would want to wear. The underlying problem is that 60% of our SMEs have no defined cybersecurity strategy and operate under the false impression that they are not a relevant target. Thinking "I'm too small to get hacked" is the biggest mistake a manager can make today; criminals are not only after big whales, they prefer to catch thousands of SMEs because they know their defences tend to be made of paper and that the financial impact, although smaller per company, is massive overall.
The impact is not just a figure on a balance sheet; it is a domino effect that compromises the entire ecosystem. An attacked SME is often the gateway to hit large corporations through the supply chain. And business interruption is unforgiving: five days of paralysis can mean €95,000 in direct operating losses and the cancellation of contracts vital to the organisation's future. Money can sometimes be recovered, but reputation goes down the drain as soon as your customers see your official account promoting cryptocurrency scams or counterfeit products.
Attackers don't go in blind; they use bots that scan Facebook for pages with active advertising. They are interested in any business with a steady flow of ads, from an estate agency on the Costa del Sol to a spare parts shop in Madrid. Having active ads confirms that there is a credit card or credit line linked to the account.
Once the company has been located, they research who the admins are. SMEs often make the mistake of having very exposed personal profiles, with corporate email addresses that have already been leaked in previous data breaches. In Spain, in 2024 alone, 3.8 million compromised email and password combinations were detected online, which means the bad guys only need to cross-reference data to see who holds the keys to the castle.
This is where criminals show they can sell anything better than anyone. Phishing is the star method, but with a frightening level of sophistication. Instead of shoddy emails full of spelling mistakes, they send notifications that look as if they came straight from Mark Zuckerberg's office. The most dangerous technique abuses legitimate Meta features to send emails from the genuine facebookmail.com domain.
These messages usually play on three feelings: fear, urgency or ambition. Fear comes with warnings that "your account will be suspended for copyright infringement"; urgency appears with "mandatory verification required within 24 hours"; and ambition is triggered by fake invitations to free advertising credit programmes or access to Meta Verified. The user, usually in a hurry with a thousand tasks, sees an official Facebook email, panics about losing their sales tool and clicks without thinking. That is where the attack starts to take shape.
This is where many people get confused. It has been shown that attackers are no longer just after your password; they want your session. They are running malvertising campaigns promoting AI tools or browser extensions that promise miracle features for your ads. When you install these extensions, the malware doesn't ask for your password; it steals your browser's session cookies.
Cookie theft is the master stroke. By obtaining that token, the attacker clones your active session on their own computer. Facebook sees that the legitimate user is logged in and asks for neither passwords nor two-factor (2FA) codes. It is like having your car keys stolen while the engine is running: they don't need the immobiliser code because the car is already started. Once inside, criminals move at lightning speed: they add new ghost admins, change the recovery emails and lock you out of your own digital business.
When a Spanish SME loses access to its account, the criminal wastes no time. The goal is to monetise the access before Meta's automated systems detect anything unusual. The first move is usually to drain the advertising funds. Attackers create new campaigns with inflated budgets, sometimes thousands of euros a day, to promote third-party scams such as fake stock market investments or miracle products.
The financial blow is immediate. Criminals take advantage of the saved card to spend as much as possible in the shortest time, often hiding these ads among the company's legitimate ones so that the owner doesn't notice the increased spend unless they check Business Manager every day. In one documented case, a company saw its advertising bill multiply tenfold in a single weekend while Meta support gave no sign of life.
But ad money is not all they are after. A business account with thousands of followers is an enormously trusted asset. Attackers use the stolen account to send direct messages to followers asking for money, offering fake discounts or requesting bank details under the guise of a special promotion. For the customer, the message comes from the furniture shop or the restaurant they always go to; trust is total and victims fall like flies. The brand damage is so deep that many companies never recover their pre-attack sales levels.
Analysing real cases in Spain, we see that most hacks are not caused by a Facebook security flaw but by basic human blunders that repeat over and over again. Cybersecurity is not software you buy; it is the habit of locking the warehouse door every day.
Many business owners feel safe because they have enabled the code sent to their phone by SMS. Wrong. SMS is currently one of the least secure forms of two-factor authentication: criminals can intercept those messages or, as we have seen, bypass them entirely by stealing session cookies. Continuing to rely only on SMS is like installing a security lock but leaving the key under the doormat.
Another textbook mistake is having a single admin or excessive privileges. In many SMEs the owner is the only one with full access, and if their account is stolen, the business dies. Or the opposite: admin access is given to external agencies, interns or employees who no longer work at the company, creating dozens of back doors nobody is watching. A compromised account belonging to a former employee can be the end of your Business Manager if you haven't cleaned up access in time.
This is where many people slip up: they use the same computer, and even the same browser, to manage the company's Business Manager and to let their children download games or pirated software. A single trojan on a personal device can capture the cookies of every company account in seconds, which is why the lack of separation between personal and professional use is an invitation to disaster.
You don't need to be a computer genius to avoid this kind of situation. Most attacks are stopped by three or four easy-to-implement measures that any SME can put in place today.
Traditional passwords leak like a sieve. The big recommendation for 2026 is to use passkeys. Meta already lets you set them up in Accounts Center: instead of a password someone can steal with a fake email, you use your phone's biometrics (fingerprint or face) or your device PIN. This is immune to phishing because there is nothing you can type into a fraudulent website; the key physically lives on your phone.
If your business depends on Facebook, spend €50 on a physical security key such as a YubiKey: a USB device you must physically touch to authorise a login. Not even the smartest hacker in the world will be able to get into your account from Russia or Vietnam without that piece of plastic plugged into their computer. It is by far the most robust measure to protect Business Manager's main admins.
The best technology is useless if someone opens the door from the inside. That is why the team must be trained to understand that Meta will NEVER ask for passwords via chat or by phone. If an "account suspended" email arrives, the golden rule is: don't click the link; open your browser, type the Business Manager address yourself and check whether there are real alerts in the dashboard. If the warning is genuine, it will appear there.
If you have already been hit, prepare for a process that is a real headache. Meta's support for small businesses is notorious for being a wall of automated replies that often resolve nothing. Many business owners spend months sending photos of their ID and company deeds only for a bot to close the ticket without explanation.
The first thing to do is go to facebook.com/hacked and try to regain access using alternative email addresses or phone numbers the hacker may have forgotten to delete. But be careful: if the criminal has enabled their own 2FA, you will be locked out for good unless you manage to talk to a human at Meta, something that sometimes only happens by paying for a Meta Verified subscription to get priority support, and even then success is not guaranteed. The harsh reality is that it is a thousand times cheaper to spend an afternoon setting up security than six months trying to get Facebook to give you back your digital life.
We cannot lower our guard, because the bad guys don't. By 2026 we expect impersonation attacks to use voice deepfakes to call SME employees posing as Meta technical support or even as the company owner. Artificial intelligence is making phishing increasingly difficult to spot with the naked eye.
The only real defence is cyber resilience: assuming that someone will try to attack you and having tested backup plans. That includes backing up your data, not depending on a single sales channel and, above all, maintaining a culture of healthy suspicion towards anything online that smells of urgency. At Ciberseguridad 720 we know that, for an SME, security is not optional; it is the difference between opening the shutters every morning and becoming one more statistic in INCIBE's reports.
Are you going to keep trusting your business to an eight-character password and an SMS anyone can intercept, or are you going to put a real lock on your Business Manager before it's too late?
The Ciberseguridad 720 team
Keep exploring the same topic with more practical reads already available in the blog.
White, black and grey hat hackers, hacktivists and APT groups: who attacks companies, what drives them and why SMEs are increasingly in their sights.
Ciberseguridad720
Editorial Team
Reused passwords, phishing clicks, shadow IT, skipped updates: the 10 human errors behind most cyber incidents in SMEs and how to prevent each one.
Ciberseguridad720
Editorial Team
A free, practical cybersecurity checklist for SMEs: strong passwords, 2FA, updates, backups, phishing awareness, encryption and least privilege, with no big budget.
Ciberseguridad720
Editorial Team