ENISA 2026: public administration absorbs a third of EU incidents

ENISA published its Threat Landscape 2026 on 22 September 2026. It analyses the incidents and events the agency collected and observed in the EU from 1 January to 31 December 2025.

Public administration was the most targeted sector, with 32% of recorded cases, ahead of business services (8%), transport (8%), manufacturing (7%) and finance and banking (6%). Nearly three quarters of the targeted organisations, 73%, fall under the NIS2 directive as essential or important entities. Within public administration, 82% of the recorded events were denial-of-service attacks driven by ideology, the hallmark of hacktivist groups aligned with ongoing conflicts.

ENISA keeps ransomware as the incident type with the greatest short-term impact and expects AI to play a growing role in malicious operations. The report is free to download from the agency's site.

Why it matters Hacktivist DDoS is noisy but rarely the costly event; its volume can mask the quieter intrusions that precede ransomware or espionage. For organisations in scope of NIS2, the sector shares are a useful baseline when deciding what a threat-intelligence programme should watch first.