ENISA Warns Digital Dependencies Are Expanding Europe’s Cyber Attack Surface

A new wave of professionals is transforming Governance, Risk, and Compliance from a rigid framework into a dynamic force for trust, innovation, and resilience. Governance, Risk, and Compliance (GRC) has long been associated with boardrooms and bureaucracy—a domain reserved for executives and auditors. But that image is changing fast.

More than half of the cyber incidents recorded by the European Union’s cybersecurity agency in 2025 involved distributed denial-of-service (DDoS) attacks. Most caused limited damage, but their simplicity remains a concern. In many cases, a political statement, an election, a protest or a development in the war in Ukraine was enough to trigger an attack.

According to ENISA’s latest Threat Landscape report, hacktivist groups claimed 4,709 attacks against EU Member States during the year. More than 89% of those attacks were DDoS campaigns, with public administrations among the main targets.

The figures highlight an important feature of Europe’s current cyber threat environment. Ransomware continued to be one of the most damaging forms of cybercrime, yet DDoS attacks made up 51% of all incidents recorded by ENISA. Ideological motives were behind 57% of threats targeting or affecting the EU, while financial motives accounted for almost 30%.

ENISA based its assessment on incidents and events observed between January 1 and December 31, 2025. Its analysis drew on publicly available information, anonymized data provided by EU Member States and information shared through the agency’s Cyber Partnership Programme.

Public administration was the most frequently targeted sector, accounting for 32% of recorded incidents. Business services and transport each represented 8%, followed by manufacturing at 7% and finance and banking at 6%.

Attack numbers, however, do not necessarily tell the whole story. Ideology-driven DDoS attacks accounted for 82% of incidents recorded against public administrations. While the volume was high, many of these attacks did not result in serious or lasting damage.

There is still reason to take the figures seriously. ENISA found that 73% of the organizations targeted were classified as essential or important entities under the EU’s NIS2 cybersecurity rules.

The agency’s 2026 NIS360 assessment had already highlighted a number of sectors facing a difficult combination of high criticality and comparatively lower cybersecurity maturity. These included healthcare, railways, maritime transport, ICT management services, space, public administration, drinking water and wastewater.

The latest Threat Landscape report adds another dimension to that concern: organizations are increasingly dependent on one another.

ENISA continues to see attacks aimed not only at individual organizations but also at their wider cyber dependencies, including suppliers, software providers and other third parties. A successful compromise at one point in the supply chain can potentially give an attacker access to several other organizations.

That means securing an organization’s own network is no longer enough. Its exposure can also depend on the security practices of the companies and technologies it relies on.

“The analysis highlights how threats become more interconnected and how threat groups spread their impact across the larger map of digital services and infrastructures,” ENISA Executive Director Juhan Lepassaar said.

The same interconnectedness can be seen among the attackers themselves. ENISA found that cybercriminals, hacktivists and state-linked groups are increasingly relying on similar tools, infrastructure and methods, even when their objectives are very different.

Cybercrime accounted for 36% of the events analyzed by ENISA. Within financially motivated activity, ransomware accounted for 40%, data breaches for 31% and fraud and impersonation for 19%.

Ransomware groups continued to combine data theft with encryption and extortion. Phishing remained one of the most common ways of gaining access to organizations, while ENISA also pointed to the growing use of phishing kits, criminal services and techniques such as ClickFix.

The number of vulnerabilities being disclosed is adding to the pressure. More than 48,000 new Common Vulnerabilities and Exposures (CVE) identifiers were recorded in 2025, representing a 22% increase from the previous year.

Both known vulnerabilities and newly discovered, or zero-day, vulnerabilities continued to be used as entry points by attackers.

ENISA could identify the initial intrusion vector in only 5% of the unauthorized-access incidents it examined. Of that limited group, 60% involved exploitation of a vulnerability. The figure should therefore not be read as meaning that vulnerabilities were responsible for 60% of unauthorized access incidents overall.

Stolen data and credentials are also feeding a growing fraud economy. ENISA highlighted the use of so-called Baiting News Sites, which imitate legitimate news or financial websites and lure victims with promises of easy investment returns. The European Banking Authority has estimated that online investment fraud cost around €4 billion across the European Economic Area in 2024.

State-linked activity remains another major part of the picture. ENISA reported that state-nexus intrusion sets were responsible for intrusion operations in 87% of the recorded activity attributed to them, while phishing campaigns accounted for 12%.

Artificial intelligence is now becoming part of this wider threat landscape. ENISA observed the use of AI-generated text as well as synthetic audio and video in foreign information manipulation and interference campaigns. The technology can make it cheaper and faster for threat actors to create content, translate it and distribute it to larger audiences.

AI is also being used to support existing cyber operations. At the same time, the growing adoption of AI systems by organizations is creating new assets that attackers may attempt to compromise.

But the rise of AI does not mean that older threats have disappeared. Phishing continues to work. Vulnerabilities continue to be exploited. Ransomware continues to disrupt organizations, while DDoS attacks remain an inexpensive way of causing disruption, particularly around politically sensitive events.

The bigger issue is the environment in which these threats now operate.

A vulnerability in one widely used product can affect organizations far beyond the company that developed it. A compromised service provider can give attackers a path into multiple customers. Techniques developed for one type of campaign can also be adopted by groups with completely different objectives.

For Europe, that growing interconnectedness is becoming a central cybersecurity challenge. The more dependent critical services become on shared technologies, suppliers and digital infrastructure, the further the potential impact of a single compromise can travel.