The cyber threat facing the European Union remains substantial, the EU's cybersecurity agency has warned in a new report published on 10 November 2026. The European Union Agency for Cybersecurity, ENISA, said Europe has made significant progress in strengthening its defences, but persistent attacks, geopolitical tensions and the rapid development of artificial intelligence are creating increasingly complex risks.

The report, the State of Cybersecurity in the European Union, is the agency's biennial assessment, prepared with the European Commission and the NIS Cooperation Group under the NIS2 Directive. It assesses the threat level as substantial, unchanged from the previous report.

Ideological attacks dominate, financial attacks disrupt most

ENISA found that ideologically motivated attacks accounted for 57.3 per cent of cases recorded in 2025. Their impact was generally limited, the agency said. Financially motivated attacks represented 29.3 per cent of cases but were the most disruptive to business, particularly through ransomware. Distributed denial of service attacks made up 51.3 per cent of recorded incidents, according to the report.

Geopolitical developments, including Russia's war against Ukraine and conflicts in the Middle East, continued to shape malicious cyber activity, the report said. It also pointed to the growing use of artificial intelligence by attackers, mainly through off-the-shelf tools that increase the speed and scale of familiar techniques rather than changing the nature of attacks outright.

Supermarket fridge attacks expose everyday risks

Recent incidents cited in the report include the hacking of refrigeration systems in supermarkets across several European countries, including France, Belgium, Sweden, Ireland and Estonia, with temperatures raised remotely. In France, a cyberattack also affected cold-storage systems at three facilities operated by the national blood service.

Supermarkets in at least 12 European countries were hit by cyberattacks in October and November, with France the worst affected, according to AFP. The European Commission said in a joint statement that several commercial refrigeration systems had been affected since 11 October, with a new wave of incidents on 1-2 November, and it advised organisations to take immediate action to limit their exposure.

ENISA Executive Director Juhan Lepassaar warned that the same weakness could soon reach homes. After the recent attacks on supermarket fridges, home appliances could be next, he told AFP on Tuesday, adding that routers and other connected devices could also be targeted. He said security should not and cannot be an afterthought, and urged Europe to invest more to counter growing cyber threats.

The Commission has been careful not to attribute the refrigeration incidents from the podium, saying investigations are being carried out by national authorities. ENISA's report likewise focuses on the gaps the incidents exposed, rather than on who was behind them.

Preparedness is improving, but unevenly

Despite the risks, ENISA reported improvements in preparedness across the EU. The overall EU Cybersecurity Index reached 71.53 points out of 100, with 22 member states achieving a mature cybersecurity posture, two reaching an advanced level and three remaining at an established level.

National cybersecurity policy implementation scored 66.72 points, while supply chain security management among essential entities reached 89.91 points. Research and development priorities also performed strongly, scoring 79.24 points.

Significant differences remain between member states, however. The maturity of computer security incident response teams averaged just 54.76 points, and national cybersecurity certification ecosystems scored 55.56 points. While 14 member states achieved mature or advanced levels, 13 remained at foundation or developing levels. Education also lagged in places: cybersecurity was included in primary school curricula in 14 member states and in secondary school curricula in 13.

New rules alone will not be enough

Regulatory compliance is the principal driver of cybersecurity investment, cited by 70 per cent of surveyed organisations, according to the report. ENISA warned, however, that differences in operational capabilities, outdated technologies and supply chain vulnerabilities continue to expose essential services to risk.

There has also been progress in vulnerability management. Since 2024, the number of member states without an established or developing national coordinated vulnerability disclosure policy has fallen from 17 to seven. The EU continues to implement the NIS2 Directive, the Cyber Resilience Act and the Cyber Solidarity Act. The main cybersecurity requirements of the Cyber Resilience Act will apply from 11 December 2027.

ENISA identified five priorities for the period ahead: improving legislative implementation, strengthening operational crisis response, increasing the resilience of critical infrastructure, managing supply chain and cross-border risks, and investing in cybersecurity education and skills. Its message is that Europe is getting better at defending itself, but attackers are improving too, and the everyday systems people rely on are now part of the front line.