Europe Cyber Threats Hit a Record High, and ENISA Has the Numbers

Europe cyber threats reached a record 8,257 recorded incidents in 2025, according to ENISA’s newly published 2026 Threat Landscape Report — and the pattern behind those numbers should worry anyone running critical infrastructure or public services on the continent.

The report, released this week, is ENISA’s most detailed picture yet of how attacks against Europe’s digital backbone are evolving. It’s not just more attacks. It’s attacks that cascade further, hit softer targets, and increasingly use AI to move faster than defenders can respond.

Public administration is absorbing the worst of it

Public administration accounted for 31.8 percent of all recorded incidents — by far the largest single category. Business services followed at 8.5 percent, transport at 8 percent, manufacturing at 6.9 percent, and finance and banking at 5.6 percent. Government websites faced repeated DDoS campaigns tied directly to elections and geopolitical flashpoints, including the ongoing Russia-Ukraine conflict.

DDoS attacks made up 51.3 percent of the incident total, with unauthorized access responsible for another 39.5 percent. Ransomware, while a smaller slice by volume, proved to be the most disruptive category by impact. One Swedish IT supplier’s ransomware attack alone rippled outward to affect around 200 municipalities — a single point of failure cascading through an entire interconnected regional government system. That’s the story ENISA keeps telling in different forms: it’s rarely the direct target that suffers most, it’s everyone downstream of them.

The entry point is almost always the same

Here’s the part that should be uncomfortable for security teams: phishing accounted for 77.8 percent of social engineering techniques used in these incidents. Not zero-days. Not exotic exploits. Phishing, still, in 2026, after two decades of security awareness training budgets. Attackers have also started leaning on ClickFix-style tactics and trusted messaging platforms like Signal and WhatsApp to manipulate targets — channels people trust precisely because they feel personal and outside the corporate security perimeter.

Supply chain risk is the other thread running through the whole report. Attackers are going after third-party providers, cloud environments, and software supply chains rather than hardened front doors. Compromised code repositories, malicious browser extensions, and tampered software libraries exposed organizations that had done everything right on their own systems — the weakness came from somewhere else in the chain entirely.

AI is now the accelerant on both sides

ENISA’s report flags something that used to be speculative and is now just operational reality: both criminal groups and state-linked actors are actively weaponizing AI. It’s being used for more convincing phishing content, faster malicious code development, and automating the post-exploitation stages that used to require skilled human operators working manually. ENISA’s Executive Director, Juhan Lepassaar, framed the core challenge as understanding how threats are becoming more interconnected — not isolated incidents, but a web where one weak link anywhere can expose organizations that never made a single mistake themselves.

That interconnection is exactly why point solutions are losing ground. A firewall alone doesn’t stop a compromised npm package three vendors upstream. Awareness training alone doesn’t stop a WhatsApp-based social engineering attempt that never touches a corporate inbox.

Key Takeaways

• 8,257 incidents recorded in 2025: ENISA’s 2026 report documents a record year for attacks on European digital infrastructure.
• Public administration is the top target: 31.8% of incidents hit government systems, often via DDoS tied to elections and geopolitical events.
• Phishing still dominates entry: 77.8% of social engineering attacks relied on phishing, now amplified by trusted platforms like Signal and WhatsApp.
• Supply chains are the soft underbelly: Compromised repositories, extensions, and libraries exposed organizations with otherwise solid internal security.
• AI now accelerates both attack and defense: Criminal and state-linked groups use AI for phishing and post-exploitation, raising the speed bar for every defender.

How TecniForge Can Help

At TecniForge, we help businesses navigate these technology shifts. Whether you need custom software development built with supply-chain security in mind, AI-driven threat monitoring, or a cloud migration hardened against the exact patterns ENISA just documented, our team builds scalable solutions that treat security as infrastructure, not an add-on. Talk to our experts about closing the gaps a phishing email or a compromised dependency could otherwise open.

With attacks this interconnected, is your organization actually checking its third-party dependencies, or just hoping none of them get compromised first?