Introduction: The Threat Picture Sharpens

This year’s edition arrives at a moment of heightened strategic complexity: the geopolitical context drives state-nexus cyber operations and triggered waves of ideologically motivated campaigns. At the same time, the EU’s regulatory framework (NIS2, GDPR, the AI Act, the Cyber Resilience Act, and the Cyber Solidarity Act) is maturing into a system that increasingly shapes how organizations must anticipate, detect, and respond to threats.

The picture that emerges is not one of a single dominant threat, but of an interconnected ecosystem in which volume and impact diverge, ransomware operators evolve faster than defenses, supply chains remain acutely vulnerable, artificial intelligence amplifies both offense and defense, and state-nexus actors operate with growing sophistication.

This alert unpacks what that means for legal, compliance, and privacy professionals.

The Threat Hierarchy: Volume vs. Impact

One of ETL 2026’s most important analytical contributions is its insistence on separating volume from impact. The raw incident numbers tell one story; the damage assessments tell another.

By volume, DDoS attacks dominated, accounting for 51.3% of all incidents. The vast majority were hacktivist operations. Ideology-driven incidents overall represented 57.3% of the total, yet ENISA consistently characterizes their operational impact as low.

Financially motivated incidents, at 29.3% of the total, are telling a different story. These were far more likely to result in significant operational disruption, data loss, and financial harm. Ransomware accounted for 47.3% of financially motivated claims, and the affected sectors, manufacturing (25.2%) and business services (18.7%), represent the backbone of European industrial and commercial activity.

Cyberespionage, at just 6.3% of incidents, may appear modest by the numbers, but ENISA identifies it as the most significant long-term strategic threat. State-nexus actors operating in this space target intellectual property, diplomatic communications, defense infrastructure, and critical supply chains, whose compromise has cascading geopolitical consequences that extend well beyond the initial intrusion.

For legal and compliance teams, the takeaway is clear: incident counts are a poor proxy for risk. Boardroom attention and resource allocation should be calibrated to impact, not frequency. A well-resourced ransomware group or state-nexus actor with a foothold in a single supplier poses orders of magnitude more risk than thousands of low-impact DDoS attempts.

Ransomware’s Evolution: From Encryption to Extortion

If last year’s threat landscape signaled ransomware’s pivot away from pure encryption, ETL 2026 confirms it as a structural shift. The data is stark: 73.3% of ransomware impact actions involved data exfiltration over command-and-control channels, while only 13.7% relied on traditional file encryption.

This inversion has profound implications. Encryption-focused defenses, such as air-gapped backups, rapid restoration protocols, and endpoint detection and response (EDR), remain necessary but are no longer sufficient. If the attacker’s primary leverage is the threat of publishing stolen data, the organization’s exposure is fundamentally different. The harm is reputational, regulatory, and commercial, not just operational.

Germany (26.5%), France (14.7%), Italy (13.6%), and Spain (12.2%) were the most targeted Member States, with the Netherlands (4.7%) rounding out the top five. The concentration in large industrial economies is unsurprising but underscores the exposure of organizations with significant EU manufacturing, logistics, and services footprints.

Perhaps most notable for legal practitioners is Qilin’s “call lawyer” feature. This innovation explicitly exploits GDPR and incident-reporting obligations as a pressure mechanism. By alerting victims that stolen data triggers mandatory notifications, the attackers weaponize the regulatory framework itself, turning compliance obligations into extortion leverage. Organizations should anticipate that future ransomware negotiations will increasingly involve legally informed adversaries who understand data protection timelines, supervisory authority notification triggers, and the reputational calculus of disclosure.

The report also highlights the growing use of EDR-disabling tools such as EDRKillShifter and HRSword, which undermine a key defensive layer. Vulnerability exploitation accounted for 60.4% of unauthorized access intrusion vectors, while phishing remained the dominant social engineering technique at 77.8%.

Supply Chains and Digital Dependencies: The Achilles’ Heel

ETL 2026 devotes significant attention to the systemic risk posed by supply chain and third-party dependencies, and for good reason. A single compromised supplier, cloud provider, or software component can cascade across hundreds or thousands of downstream organizations, creating incident volumes and regulatory exposures that no single entity can manage in isolation.

The report catalogs attacks across the full spectrum of digital dependencies: third-party IT service providers, cloud platforms, SaaS applications, CRM systems, developer tools, and open-source package managers.

The Collins Aerospace ransomware incident, which disrupted check-in systems at multiple EU airports, illustrated how a single supplier compromise can produce immediate, visible, and geographically distributed operational impact (and the lack of any coordinated EU response, irrespective of the existing frameworks).

AI: Force Multiplier Today, Autonomous Threat Tomorrow?

Artificial intelligence’s role in the threat landscape is evolving rapidly. The current picture is one of augmentation rather than revolution: AI is enhancing existing threat actor capabilities across reconnaissance, social engineering, malware development, and information manipulation, but it has not yet produced a breakthrough that fundamentally changes the threat equation.

That said, the operational applications are increasingly concrete. ENISA documents AI-generated malware deployed in real-world contexts, including an LLM-produced React2Shell exploit. One AI-assisted cloud intrusion achieved administrative access in just eight minutes. Phishing campaigns are leveraging AI-generated content to overcome language barriers and improve targeting. And synthetic identities created with generative AI are being used in fraud and social engineering operations.

The proliferation of AI in foreign information manipulation and interference (FIMI) is particularly striking. ENISA reports a 259% increase in AI-related FIMI tactics, techniques, and procedures, from 41 documented cases in 2024 to 147 in 2025. ClickFix phishing kits, AI-powered reconnaissance, and AI-generated disinformation content are all becoming standard parts of the adversarial toolkit.

Looking ahead, ENISA expects “human-out-of-the-loop” experimentation by threat actors in 2026, meaning autonomous or semi-autonomous offensive operations where AI systems make targeting, exploitation, and lateral movement decisions without direct human oversight. While still nascent, this trajectory demands that organizations think about AI security on two axes: AI as a tool used by adversaries, and AI systems as targets in their own right.

State-Nexus Actors: The Strategic Undercurrent

State-nexus cyber operations remain the most strategically significant dimension of the threat landscape, even if they represent a smaller share of total incidents. Russia (47.6%) remained the dominant state-nexus threat, with APT28, APT29, Turla, Callisto, and Storm-2372 targeting diplomatic missions, defense ministries, logistics providers, and IT suppliers supporting Ukraine. China (15.5%) focused on strategic intelligence collection against maritime, telecommunications, and network infrastructure, including through rapid vulnerability exploitation. North Korea (14.1%) combined cybercrime and intelligence operations, including fraudulent IT-worker placements and cryptocurrency theft by Lazarus and BlueNoroff. Iran (9%) expanded activity amid the Israel-Iran conflict, targeting regional adversaries and European entities connected to Middle East policy and diplomacy.

For organizations in sectors of strategic interest (defense, telecommunications, energy, transportation, maritime, and technology), the state-nexus threat demands a risk posture that goes beyond compliance. Incident response plans, threat intelligence capabilities, and board-level awareness should account for adversaries whose resources, patience, and sophistication far exceed those of financially motivated criminals.

The Regulatory Lens: NIS2, GDPR, and the Expanding EU Framework

ETL 2026 provides compelling data on the intersection of the threat landscape and the EU’s regulatory framework. Approximately 73% of all recorded incidents affected entities classified as essential or important under NIS2. Member States reported 1,954 NIS2 events, with health and digital infrastructure among the top five reporting sectors. Public administration alone accounted for 31.8% of all targeted sectors, underscoring the degree to which government entities, and the services they provide to citizens, are in the crosshairs.

GDPR’s role in the threat landscape has taken an unexpected and adversarial turn. As discussed above, ransomware operators are now explicitly weaponizing GDPR’s notification and compliance obligations as leverage in extortion negotiations. This is a significant development for legal teams managing incident response: the regulatory framework designed to protect data subjects is being turned against data controllers by threat actors who understand it well enough to exploit its pressure points.

The broader regulatory picture continues to expand: the AI Act introduces cybersecurity obligations for high-risk AI systems; the Cyber Resilience Act will impose security requirements on products with digital elements throughout their lifecycle; and the Cyber Solidarity Act establishes a European Cyber Shield and mechanisms for coordinated cross-border incident response. Together with NIS2 and GDPR, these instruments create an increasingly dense and interconnected web of obligations.

What This Means for Your Organization

ETL 2026’s findings translate into a set of concrete priorities for legal, compliance, and risk professionals:

• Treat cybercrime as the primary near-term business continuity risk: Financially motivated attacks, particularly ransomware and data extortion, pose the most immediate threat to most organizations. Ensure response plans and crisis protocols reflect an extortion-centric model.
• Strengthen vulnerability management as a core compliance function: With attackers weaponizing vulnerabilities within constancy decreasing timeframes, vulnerability management is no longer purely a technical exercise. It is a regulatory expectation under NIS2, a due diligence obligation, and a demonstrable measure of organization resilience.
• Secure your supply chain and third-party dependencies with contractual and technical rigor: Map critical dependencies, assess suppliers, impose security obligations, and require timely breach notification. NIS2 requires it, and operational reality demands it.
• Harden identity and authentication controls: Unauthorized access accounted for 39.5% of all incidents. Phishing (77.8% of social engineering) and credential theft remain primary entry points. Multi-factor authentication, privileged access management, and zero-trust architecture are not aspirational but baseline expectations.
• Prepare for extortion without relying solely on encryption-focused controls: Data loss prevention, network segmentation, and data classification should complement backups and restoration plans.
• Integrate AI security into your enterprise risk management framework: Assess both AI-enabled attacks and the attack surface created by internal AI deployments, including the cybersecurity requirements emerging under the AI Act.
• Maintain a strategic risk perspective beyond incident counts: Boards and senior leadership should distinguish high-volume, low-impact campaigns from low-volume, high-impact operations and align resources accordingly.

Conclusion

The ENISA Threat Landscape 2026 paints a picture of an EU cyber battleground that is more complex, more interconnected, and more consequential than in any prior year. Threats are not merely growing in volume; they are evolving in sophistication, exploiting the EU’s own regulatory framework as leverage, and targeting the digital dependencies that underpin modern commerce and governance.

Organizations that integrate threat intelligence into their legal and compliance functions, rather than treating it as a purely technical discipline, will be better positioned to anticipate, withstand, and recover from the threats ahead.