Heraklion: The ENISA Threat Landscape 2026 gives Europe its clearest picture yet of who attacks EU networks and why, and it lands in the middle of European Cybersecurity Month. The EU cybersecurity agency released the report on 22 September 2026. It covers 1 January to 31 December 2025 and draws on open sources, anonymised information from member states and the ENISA Cyber Partnership Programme.
Cybercrime accounts for 36% of all events in the ENISA Threat Landscape 2026. Ransomware makes up 40% of those cybercrime events, data breaches 31% and fraud or impersonation 19%. The agency still calls ransomware the most immediately damaging incident type.
Ideology matters almost as much as money. According to the report, 57% of incidents affecting the EU were ideology-driven, while almost 30% had a financial motive. Hacktivists lodged 4,709 claims against EU member states, and more than 89% of them were distributed denial-of-service attacks. Low-impact DDoS incidents represent 51% of recorded cases, which shows how noisy but shallow much of the activity is.
Public administration is the most targeted sector, with 32% of cases. Ideology-driven DDoS made up 82% of the events against it. Business services and transport each draw 8% of cases, manufacturing 7% and finance and banking 6%. The ENISA Threat Landscape 2026 also found that 73% of targeted organisations were essential or important entities under the NIS2 Directive, so the attackers are going after the very operators that EU law now obliges to raise their defences.
State-aligned actors work differently. Intrusion operations account for 87% of state-nexus activity and phishing for 12%. The authors stress that the lines between cybercrime, hacktivism and state activity keep blurring, because groups reuse the same tools and techniques. That overlap makes attribution harder and complicates any political response.
Vulnerabilities supply much of the fuel in the ENISA Threat Landscape 2026 data. More than 48,000 new CVEs appeared in 2025, a 22% rise on the previous year. Where ENISA could identify how intruders got in, which it managed in only 5% of unauthorised access cases, 60% involved exploiting a vulnerability. The thin attribution rate is a finding in itself, since it tells defenders how little visibility they have into the early stages of many breaches.
Social engineering remains a common way in. Phishing kits and the ClickFix technique keep tricking users, and criminals increasingly use artificial intelligence to produce synthetic audio, video and text for operations and for foreign information manipulation. AI systems are also becoming targets in their own right. Fraudsters lure victims through baiting news sites into investment scams, a trade the European Banking Authority estimates cost about €4 billion across the European Economic Area in 2024.
Supply-chain and third-party attacks continue to cause large-scale damage. The ENISA Threat Landscape 2026 notes that cyber dependencies widen the attack surface and calls for heightened vigilance. Its NIS360 analysis adds that health, railway, maritime, ICT management services, space, public administration and drinking and wastewater sectors show below-average maturity compared with how critical they are.
For policymakers, the message is practical. NIS2 now binds operators across the EU, and those in the weakest sectors face the steepest climb. European Cybersecurity Month, which ENISA and the European Commission coordinate every October, gives governments and companies a natural moment to act on the evidence. The ENISA Threat Landscape 2026 will likely shape that conversation well beyond the campaign.
