ENISA Report Highlights Ransomware, DDoS and Supply-Chain Risks Across the EU

Summary

ENISA’s 2025 EU threat-landscape analysis finds ransomware, DDoS and vulnerability exploitation remain prominent, with public administration the most targeted sector and cyber dependencies a source of significant risk.

Key points

• ENISA analysed incidents and events observed from 1 January to 31 December 2025, drawing on open sources and information shared by EU Member States and its Cyber Partnership Programme.
• Ransomware remained highly disruptive; among financially motivated activity, ransomware accounted for 40% of analysed events, data breaches 31%, and fraud and impersonation 19%.
• DDoS made up 51% of recorded cases and was mostly low impact; 82% of recorded events targeting public administration involved ideology-driven DDoS.
• Public administration was the most targeted sector, accounting for 32% of cases; 73% of targeted organisations were essential or important entities under NIS2.
• Social engineering, including phishing and the ClickFix technique, remained common. Among unauthorised-access incidents where ENISA identified an intrusion vector, 60% involved a vulnerability.
• ENISA highlights supply-chain and third-party attacks as risks to digital dependencies that can lead to large-scale or impactful incidents.
• The report notes growing malicious use of AI and interest in AI systems as both tools for malicious activity and targets for exploitation.

People

Industries