1. Executive summary
ENISA published its Threat Landscape 2026 report on 24 September 2026, covering 8,257 incidents recorded across the EU between 1 January and 31 December 2025. DDoS accounted for 51.3% of recorded incidents and unauthorised access for 39.5%; ransomware remained a major source of disruption, and one ransomware attack on a Swedish IT supplier disrupted HR reporting systems for around 200 municipalities and regional authorities. Finance and banking accounted for 5.6% of recorded incidents, the second-lowest share of the sectors ENISA breaks out, but the supply chain finding is the part that applies directly to EMEA financial firms: compromise of a shared provider exposes customers whose own systems were never touched. No CVSS scores, CVE identifiers or CISA KEV entries are available for this item, because it is a sector trend report rather than a vulnerability or campaign disclosure. The report is single-sourced here through one Help Net Security summary of the ENISA publication.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
The report describes aggregate EU incident statistics for 2025. It names no affected institution, no exploited vulnerability and no live campaign, so no fact in it triggers a reporting, classification or testing obligation for a client on its own. The supply chain and third-party concentration findings are relevant to how a client scopes its own supplier risk work, but "a third party is involved" is true of most incidents and does not by itself engage a specific article. Clients should treat this advisory as input to existing supplier risk and resilience programmes, not as a regulatory trigger.
3. Technical analysis & attack chain
This is a strategic item. There is no attack chain to reconstruct: the source is a summary of ENISA's annual incident statistics, not a disclosure of a specific intrusion. What follows is how the recorded activity actually worked, using only the facts ENISA reports.
The dataset is 8,257 incidents recorded between 1 January and 31 December 2025. ENISA collected the data mainly from open sources, supplemented by anonymised information shared by EU member states and members of the ENISA Cyber Partnership Programme. That collection method shapes the numbers: DDoS and defacement-style activity is publicly visible and therefore over-represented relative to intrusions that victims never disclose. The 51.3% DDoS share should be read as a measure of what is observable, not of what causes the most damage.
DDoS dominates the public administration sector, at 81.8% of incidents affecting it. Hacktivist groups were linked to much of that activity, with government websites and online portals targeted in connection with elections, law enforcement operations and geopolitical developments, including Russia's war against Ukraine and conflicts in the Middle East. The pattern is repeated at lower volume in business services, where DDoS accounted for 38% of incidents and unauthorised access for 56.7%.
The third-party and supply chain finding is the operationally significant one. ENISA records cybercriminals targeting third-party providers, cloud environments and software supply chains, with incidents involving compromised software, repositories and browser extensions, and attacks on widely used software libraries and packages. The mechanism is straightforward: a provider's systems connect to multiple customers, so an intrusion at the provider either interrupts service for all of them or gives the attacker a path into parts of each customer's environment. The report's worked example is a ransomware attack on a Swedish IT supplier that affected around 200 municipalities and regional authorities and disrupted systems used for human resources reporting. The affected organisations were not the intrusion target; they were downstream of it.
Ransomware remained a major source of disruption across the EU. Within financially motivated incidents affecting public administration, data breaches accounted for 38.4% and ransomware claims for 36%, with ransomware primarily affecting municipalities. State-linked groups continued to target ministries, diplomatic organisations and other government institutions for cyberespionage, with broader EU operations focused on strategic intelligence collection and possible intellectual property theft.
Sector distribution across all recorded incidents: public administration 31.8%, business services 8.5%, transport 8%, manufacturing 6.9%, finance and banking 5.6%. Public administration is the most affected sector by a wide margin; finance and banking is the second-lowest of the sectors listed.
Confidence caveats. Every figure above rests on a single source, the Help Net Security summary of the ENISA report, and Adverse Trace has not reviewed the underlying ENISA publication. The syndicated copy of the article is truncated mid-sentence in the business services section, so the ransomware figures for that sector are not available to us. ENISA attributes no incident to a named threat group in the material provided, and no actor named in this advisory has a MITRE ATT&CK profile in our reference data, so no attribution is made here.
4. Mitigation & containment
The actions below address the two exposures the report actually evidences: dependency on a shared provider, and public-facing service availability. They are process and resilience controls, not containment of a live intrusion, because no intrusion is described.
P1 (within 24 hours)
- Identify which of your critical or important functions depend on a supplier whose failure would affect multiple customers at once. The Swedish case is the template: HR reporting, payroll and similar back-office platforms are frequently single-supplier, multi-tenant and outside the security team's normal monitoring scope. Confirm for each whether you hold an offline or in-house fallback for the reporting period.
- Confirm DDoS mitigation capacity for every internet-facing portal, including customer login, payment initiation and public information pages. Check that scrubbing or CDN capacity is contracted for peak, not average, load, and that the provider's own status page is not the only channel you have for outage notification.
- Verify that your incident intake can classify a supplier-side outage as an incident affecting you. The failure mode in the Swedish case is that customers learn of the breach from service unavailability rather than from the supplier.
P2 (within 72 hours)
- Inventory browser extensions and third-party packages in your build and desktop pipelines. The report names compromised browser extensions and widely used libraries and packages as incident vectors. For build pipelines, produce the list of direct and transitive dependencies for internet-facing services and confirm which have an owner.
- Pull the breach notification and service continuity clauses from contracts with any supplier that processes or hosts a critical function. Check the notification window and whether it obliges the supplier to tell you about an incident affecting other customers of the same platform.
- Test restoration of the specific platform you identified in P1, not a generic backup restore. A restore that has never been run against the HR or reporting system is an assumption.
P3 (within 7 days)
- Run a tabletop in which the trigger is a supplier breach disclosed by a third party, not by the supplier, and the first symptom is that a business function stops working. Include the business owner of the affected function, not only security and IT.
- Review the DDoS runbook against the report's targeting pattern: government and public-facing portals hit in connection with elections, law enforcement activity and geopolitical events. If your public communications or investor relations pages sit on the same infrastructure as transactional services, separate them.
- Re-examine supplier concentration. Where two or more critical functions run on the same provider, document the correlated failure and decide whether to accept it.
5. Indicators of compromise
No indicators of compromise available in the source material.
The source is an aggregate statistical report. It contains no hashes, domains, IP addresses, file paths, registry keys or command lines, and it names no malware family. There are no behavioural indicators specific enough to be worth a detection table either: "DDoS against public-facing services" and "unauthorised access" are category labels, not observable patterns that would distinguish this activity from ordinary background noise on a monitored estate.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- Help Net Security, "Europe's technology backbone is becoming a cyber target", https://www.helpnetsecurity.com/2026/09/24/enisa-eu-cyber-threats-report/, published 2026-09-24. Single source for all figures in this advisory.
- ENISA, Threat Landscape 2026, referenced by the above. The primary report URL was not supplied in the feed and Adverse Trace has not retrieved the document; figures quoted here are as reported by Help Net Security.
8. Adverse Trace position
Adverse Trace assesses this as a context item, not an actionable threat. There is no CVE, no CVSS score, no CISA KEV entry and no named actor to work from, and the only source is a single syndicated summary of the ENISA report, so we are not raising a client alert level on the strength of it. The client impact we do see is concentrated in supplier concentration and public-facing availability: a 5.6% incident share for finance and banking is not a signal of targeting, but the Swedish supplier case shows that a financial firm can lose a critical function without being the target at all, and that is a dependency question most clients have not answered for back-office platforms. We will retrieve the underlying ENISA report and reconcile the sector figures against it, and we will treat any subsequent disclosure of a named supplier compromise or exploited component as a separate item with its own advisory. Clients who want help mapping critical functions to single-supplier dependencies should contact their Adverse Trace account team.
Published via PulseTrace — Adverse Trace threat intelligence.