Europe’s technology backbone is becoming a cyber target
ENISA’s 2026 report says DDoS and supplier compromises drove 8,257 EU cyber incidents in 2025.
ENISA’s Threat Landscape 2026 reviews 8,257 incidents recorded in the EU during 2025, drawn mainly from open sources and anonymized member-state reporting. DDoS accounted for 51.3% and unauthorized access for 39.5%, with public administration the most targeted sector at 31.8%. A ransomware attack on a Swedish IT supplier disrupted services for about 200 municipalities and regional authorities. Phishing made up 77.8% of identified social-engineering techniques, and attackers also used ClickFix, supply-chain compromises, and AI to speed existing operations.
- ENISA analyzed 8,257 EU incidents recorded during calendar year 2025.
- DDoS was 51.3% of incidents; unauthorized access was 39.5%.
- Public administration accounted for 31.8% of incidents, mostly DDoS.
- Ransomware at a Swedish IT supplier affected about 200 municipalities.
- Phishing was 77.8% of identified social-engineering techniques, including ClickFix.
Full article821 words · extracted from helpnetsecurity.com · click to collapse
Disruptive attacks on public-facing services, financially motivated cybercrime and compromises of shared technology providers are increasing cybersecurity risks across Europe.
ENISA’s Threat Landscape 2026 identifies cybercrime, state-linked activity, foreign information manipulation and interference, hacktivism and vulnerability exploitation as key threats. Geopolitical developments influence attackers’ targets, and interconnected digital systems allow disruption to spread across organizations.
Breakdown of incident types impacting the EU (Source: ENISA)
ENISA analyzed 8,257 incidents recorded between January 1 and December 31, 2025. The agency collected the data mainly from open sources, along with anonymized information shared by EU member states and members of the ENISA Cyber Partnership Programme.
“The ENISA threat landscape is more than a list of cybersecurity threats affecting the EU and how they are distributed around sectors and entities. The analysis highlights how threats become more interconnected and how threat groups spread their impact across the larger map of digital services and infrastructures. Being aware of such underlying dynamics is key if we want to implement the right solutions and maintain a high level of resilience across our digital economy,” said ENISA’s Executive Director Juhan Lepassaar.
DDoS attacks accounted for 51.3% of recorded incidents, followed by unauthorized access at 39.5%. Hacktivist groups were linked to much of the DDoS activity targeting government websites and online services. Ransomware remained a major source of disruption across the EU.
Attacks on shared technology services widen impact
Cybercriminals continued to target third-party providers, cloud environments and software supply chains. Reliance on an affected supplier can expose organizations even when their own systems have not been directly compromised.
Incidents involved compromised software, repositories and browser extensions, along with attacks on widely used software libraries and packages. Organizations can become exposed when they incorporate these components into their systems.
Technology providers are attractive targets because their systems may connect to multiple customers. An intrusion at one supplier can interrupt services or give attackers access to other parts of a digital supply chain.
ENISA cited a ransomware attack on a Swedish IT supplier that affected around 200 municipalities and regional authorities. The attack disrupted systems used for human resources reporting, demonstrating how a breach at one company can affect customers that depend on its services.
Public administration remains the most targeted sector
Public administration accounted for 31.8% of recorded incidents, making it the most affected sector. Business services followed at 8.5%, transport at 8%, manufacturing at 6.9%, and finance and banking at 5.6%.
DDoS attacks represented 81.8% of incidents affecting public administration. Attackers repeatedly targeted government websites and online portals in connection with elections, law enforcement operations and geopolitical developments, including Russia’s war against Ukraine and conflicts in the Middle East.
Of financially motivated incidents affecting public administration, data breaches accounted for 38.4%. Ransomware claims represented 36% and primarily affected municipalities.
State-linked groups continued to target ministries, diplomatic organizations and other government institutions for cyberespionage. Their broader operations across the EU also focused on strategic intelligence collection and possible intellectual property theft.
Business services, the second-most affected sector, included consulting firms, legal services, hospitality businesses, broadcast media companies and other commercial providers. Unauthorized access accounted for 56.7% of incidents affecting the sector, followed by DDoS attacks at 38%.
Ransomware deployments accounted for 54% of recorded unauthorized-access incidents affecting business services. Data breaches represented 26.5%.
Phishing and software vulnerabilities as common entry points
Phishing accounted for 77.8% of the social engineering techniques identified in incidents targeting the EU. ENISA also observed increased use of ClickFix, a technique that tricks people into running malicious commands presented as instructions for resolving a computer problem.
Attackers continued to exploit software vulnerabilities to enter systems. The agency identified an intrusion method in 5.2% of unauthorized-access incidents. Vulnerability exploitation accounted for 60.4% of that subset, meaning the figure does not represent all such attacks.
Other campaigns used trusted messaging platforms, including Signal and WhatsApp, to initiate personalized contact. Targets were guided through legitimate authentication processes that gave attackers full access to compromised devices.
AI could accelerate cyberattacks
Cybercriminals and state-linked groups used AI to support phishing, fraud, reconnaissance, malicious code development and post-exploitation activity. AI tools helped operators create tailored messages, write scripts and increase the speed of existing techniques.
Groups involved in foreign information manipulation and interference used AI-generated text, audio and video to produce content, translate it into multiple languages and distribute it to larger audiences.
AI applications have become targets because they may connect to sensitive files, credentials, browser sessions and development environments. A compromised application could provide a route into trusted systems. AI-linked development tools and software supply chains create additional opportunities for attackers seeking access to organizations and their customers.
ENISA expects advanced models to enable more stages of the attack process. Increased automation could expand the speed and scale of cyber activity and make malicious operations harder to detect. Threat groups may also experiment with systems capable of performing parts of an attack with limited human involvement.