Loading story…
The European Court of Auditors found that the EU is insufficiently prepared to detect and respond to major cyberattacks, despite allocating €1.4 billion to European cyber defence. An EU early-warning capability remained not fully operational roughly 20 months after its creation, while auditors also identified weak oversight of funding distributed to third parties and called for stronger coordination and less duplicated work.
The audit identified inadequate information-sharing among member states as a central weakness. Following a September 2025 attack on an IT service provider that disrupted passenger handling at multiple European airports, Germany, Belgium and Ireland reportedly did not notify ENISA or other member states adequately, limiting coordinated defensive action; national-security interests and secrecy rules can further restrict cross-border exchange of cyber-threat information.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
A large cyberattack against an IT service provider disrupted passenger handling at airports including London, Brussels and Dublin, forcing airlines to conduct parts of check-in manually or with external equipment.
The European Court of Auditors found the EU insufficiently prepared to detect and respond to major cyberattacks, citing inadequate information sharing among member states. Auditors also found that the EU early-warning system was not fully operational roughly 20 months after its creation and identified oversight deficiencies in distributing cyber-defence funding to third parties.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nearly every member state of the European Union was subjected to cyberattacks attributed to nation-state actors, primarily from Russia and China, over a 12-month period ending in July. According to the European Union Agency for Cybersecurity (ENISA), these attacks have steadily intensified, with only Luxembourg not publicly disclosing such incidents, a situation likely due to underreporting rather than absence of activity. ENISA's latest annual threat landscape report documented 46 nation-state-backed cyberattacks during this period, representing 7.2% of all known cyber incidents across the EU. Russian-linked threat actors were responsible for approximately half of these nation-state activities, with APT29 (Russia's Foreign Intelligence Service), APT28, and Sandworm (Units 26165 and 74455 of Russia's GRU) identified as the most active groups. The primary targets of these campaigns included public administration, diplomatic entities, defense organizations, and digital infrastructure within EU member states. Notably, APT29 was implicated in attacks against the European Space Agency and NATO partners, employing sophisticated compromise techniques. Chinese threat actors were also cited as significant contributors to the surge in cyberespionage and offensive cyber operations against European interests. The report highlights a trend of increasing sophistication and persistence in the tactics used by these nation-state actors, with a focus on intelligence gathering and disruption of critical sectors. ENISA emphasized that the true scale of these operations may be underrepresented due to limited public disclosures and possible underreporting by some member states. The agency's findings underscore the growing threat posed by state-sponsored cyber operations to the security and stability of the European Union. The attacks have prompted calls for enhanced cyber defense measures and greater information sharing among EU countries. The targeting of digital infrastructure and sensitive government entities raises concerns about the potential for long-term strategic impact and the erosion of trust in public institutions. ENISA's report serves as a warning to both policymakers and private sector leaders about the evolving landscape of nation-state cyber threats. The agency recommends increased investment in cybersecurity capabilities and cross-border cooperation to counteract these persistent threats. The findings also highlight the need for improved incident reporting and transparency to better assess and respond to the risks posed by foreign cyber operations. The ongoing campaigns by Russian and Chinese actors demonstrate a clear intent to influence, disrupt, or gather intelligence from European targets, necessitating a coordinated and robust response from the EU and its allies.
Jun 29, 2026
European Union officials said they want to help strengthen and modernize the **Common Vulnerabilities and Exposures (CVE) Program** after a 2025 contracting scare involving MITRE raised concerns about the long-term resilience of a system widely used to track and identify software flaws. ENISA cybersecurity official Hans de Vries said EU member states asked the agency to examine how to reinforce the process, arguing that such a critical global mechanism should not rely on a single U.S. government contract, while U.S. policymakers are weighing legislation that could formalize the program and expand **CISA** oversight. Officials and experts also warned that weak governance or political fragility could splinter vulnerability tracking into competing systems, undermining a core pillar of global cyber defense. The debate has also turned to improving the quality and machine-readability of CVE records at issuance, as **AI-enabled** attacks accelerate exploitation and reduce the value of delayed enrichment; CISA said a brief renewal delay in April 2025 did not interrupt operations and that **MITRE** remains the program operator.
Jun 29, 2026
Link11, a European web infrastructure security provider, has released an analysis identifying five major cybersecurity trends expected to shape defense strategies for organizations across Europe in 2026. The report highlights the increasing use of DDoS attacks as diversionary tactics, where attackers leverage these disruptions to mask more damaging activities such as network infiltration, data theft, or covert malware deployment. The findings are based on current threat activity, industry research, and insights from the Link11 European Cyber Report, as well as broader market indicators like PwC’s Global Digital Trust Insights 2026, which notes that geopolitical instability and underinvestment in proactive security measures are leaving critical gaps for attackers to exploit. The report urges European organizations to strengthen their incident response frameworks, treating any DDoS alert as a potential indicator of more serious, concurrent threats. The evolving threat landscape, marked by rapid advances in artificial intelligence and fractured supply chains, is driving a need for more robust monitoring, testing, and hardening of defenses. Link11's insights are intended to guide organizations in preparing for the complex and sophisticated cyber operations anticipated in the coming year, emphasizing the importance of proactive and comprehensive security strategies.
Jun 29, 2026