Heraklion: The ENISA Threat Landscape 2026 counts 8,257 cyber incidents against European Union organisations in 2025, according to the report that the EU Agency for Cybersecurity published on 22 September 2026. The headline figure hides a more worrying story about data theft, supply chains and slow repairs.
More than half of the incidents, 51.3 percent, were distributed denial of service attacks, which flood a website with traffic and usually cause short outages rather than lasting harm. Because those attacks are so numerous, they dominate the raw count, so the intrusion figures in the ENISA Threat Landscape 2026 give a better guide to serious damage. Intrusions, which cover ransomware, data theft and espionage, made up 39.5 percent of the total.
Where the report could identify how attackers got in, vulnerabilities led the list. It says that 60.4 percent of those intrusions exploited a vulnerability and 20.7 percent took advantage of a misconfiguration. The entry point was known for only 5.2 percent of all intrusions, so the true picture may differ from the sample.
Ransomware has changed its method, and the ENISA Threat Landscape 2026 documents the shift. The report finds that data exfiltration over the command-and-control channel appears in 73.3 percent of cases, while data encryption appears in 13.7 percent. Criminals now steal first and threaten publication, so a victim with good backups can still face blackmail.
Supply chains amplify the damage, a point the ENISA Threat Landscape 2026 stresses. One ransomware attack on a Swedish IT supplier reached around 200 municipalities and regional authorities, showing how a single compromised provider can disrupt public services across a whole country. Public administrations and other organisations that rely on shared suppliers face this kind of cascading risk.
Repair speed is a weak point as well. The median time to fix a vulnerability rose to 43 days, which gives attackers a long window to exploit known flaws. Defenders therefore need to watch outbound traffic for signs of data leaving the network, harden the edge devices that face the internet and treat misconfigurations as seriously as software bugs.
ENISA frames the findings around dependency. In the press release that accompanies the report, the agency says that cyber dependencies expand the attack surface and require a new level of vigilance to prevent and mitigate the impact of cyber incidents. That message speaks to national authorities and companies that rely on the same cloud providers, software vendors and managed service firms.
The report lands as the EU enforces the NIS2 Directive and the Cyber Resilience Act, which place legal duties on essential entities and product makers. Those rules push organisations to manage supplier risk and to report incidents, and the ENISA Threat Landscape 2026 gives regulators evidence of where the weak points lie.
For security teams, the practical lesson is to measure what hurts. Counting incidents says little unless the count separates noisy attacks from intrusions, and speed of remediation matters as much as the volume of patches. The ENISA Threat Landscape 2026 offers a baseline for 2025 that boards, ministries and suppliers can use to set their priorities for the year ahead.
