ENISA's 2026 EU threat report: 2025 incident data by sector and threat type

In two minutes

• ENISA analysed 8,257 incidents from 1 January to 31 December 2025, mostly from open sources plus anonymised Member State input, and calls the report a snapshot of prevailing trends (p. 9).
• By count, DDoS (51.3%) and unauthorised access (39.5%) lead, and ideology-driven activity is 57.3% of incidents, but ENISA says these claims mostly had no large-scale impact (pp. 11, 13).
• Financially motivated activity, especially ransomware, is described as the most impactful threat in the short term. Cyberespionage is described as a significant strategic threat in the mid to long term (p. 13).
• Public administration is the most targeted sector (31.8%), followed by business services, transport, manufacturing and finance/banking. Most of the public administration picture is hacktivist DDoS (pp. 14, 20).
• Ransomware activity is shifting from encryption towards data theft and extortion. Operators exploit VPN and firewall flaws, use ClickFix, and deploy tools that disable EDR (p. 51).
• Third-party, cloud, SaaS and software supply chain compromises keep causing large downstream incidents, such as the Collins Aerospace check-in outage and the Swedish IT supplier attack (pp. 12, 22, 30).
• Russia-nexus sets are 47.6% of State-nexus sets seen in the EU, followed by China, DPRK and Iran. DPRK IT-worker schemes (Famous Chollima) are a rising insider concern (pp. 11, 60).
• ENISA assesses AI will highly likely increasingly support malicious operations in 2026. In 2025 attackers mostly used AI to augment existing skills (pp. 8, 15). The text supplied ends at page 65 of 101, so the later chapters are covered only through the executive summary.

Key numbers

• 8 257: incidents collected and analysed for 2025 (p. 9).
• 51.3% / 39.5%: share of incidents that are DDoS / unauthorised access (p. 11).
• 57.3% / 29.2%: share of incidents that are ideology-driven / financially motivated (the executive summary gives 29.3% for the latter) (p. 13).
• 31.8%: share of all events hitting public administration, the top sector (p. 14).
• 60.4% (of the 5.2% with a known vector): unauthorised access incidents that used a vulnerability (p. 11).
• 47.3% / 36%: ransomware / data breaches as a share of financially motivated claims (p. 38).
• 73.3% vs 13.7%: ransomware TTP reports showing exfiltration over C2 vs encryption for impact (p. 51).
• 47.6%: share of State-nexus intrusion sets in the EU linked to Russia (China 15.5%, DPRK 14.1%, Iran 9%) (p. 60).

What to do with it

• Use the sector shares and ransomware strain lists (Qilin, SafePay, Akira, INC) as external reference points when you brief the board on likely threats to your sector (chapter 2, pp. 20-37).
• Review patching and monitoring of VPN and firewall appliances. The report names Fortinet, SonicWall and Cisco flaws used by ransomware crews (p. 51).
• Plan for extortion without encryption. The report shows exfiltration is reported far more often than encryption, so test data-loss detection and not only backups (p. 51).
• Check third-party and SaaS exposure. Reported cases include supplier ransomware, a customer-service platform breach and Salesforce-style data theft (pp. 12, 30, 46).
• Brief staff and helpdesk on ClickFix, vishing that impersonates IT staff, and device code phishing through Signal, WhatsApp or Teams lures (pp. 16, 46, 51).
• Review developer and package manager hygiene and DPRK IT-worker hiring risk. ENISA points to its March 2026 package manager advisory (pp. 12, 62).

Read the full document if

• you need EU-specific sector and country breakdowns of 2025 incidents to support risk reporting.
• you want the reported ransomware TTPs and MITRE ATT&CK mapping for Akira, Qilin, INC, SafePay and Hunters International (p. 52).
• you track State-nexus targeting of EU public administration, transport, telecoms and defence.
• you want ENISA's view of how AI is changing attacker tempo and creating new attack surface (pp. 15-17).

What it relies on

The report rests on ENISA's own dataset of 8,257 incidents for calendar year 2025. It draws on open sources and anonymised information from EU Member States and members of the ENISA Cyber Partnership Programme. ENISA lists caveats: vague sector or country reporting, delayed reporting of espionage, and coverage that reflects audience interest. It also notes overlaps between data breach, scam and ransomware counts. It uses words of estimative probability, and cites vendor reports, national authority advisories and press as footnotes. Information manipulation content comes from an EEAS report for 2025. ENISA is an EU agency and does not sell products. The digest reflects the text supplied, which stops at page 65.

Our read

A reference document for EU-focused threat briefings. Its main use is separating high-volume hacktivist noise from the ransomware, data theft and espionage activity that ENISA describes as more impactful. Treat percentages as shares of what open sources reported, not as measures of real activity. The footnotes point to many primary sources.