ENISA Threat Landscape

The EU’s cybersecurity agency publishes an annual Threat Landscape report ranking the threats it observed across the Union. The figures below are transcribed by hand from the published report (PDF-only) and re-published here under CC BY 4.0 with attribution to ENISA.

Reporting window: Jul 2024 – Jun 2025 · ENISA-counted incidents: 4,875 · Source: ENISA Threat Landscape 2025 (CC BY 4.0).

Top threats (2025)

Rank	Threat	Share / basis
1	DDoS / availability attacks Driven by hacktivist activity (low individual impact, very high volume).	77%
2	Ransomware Most operationally disruptive category despite lower volume share.	impact
3	Data breaches	17%
4	Phishing % of incidents that began with phishing; not exclusive to one category.	60%
5	Supply-chain compromise	—
6	Exploited vulnerabilities	—

Most-targeted sectors

Sector	Share of incidents
Public Administration	63.1%
Transport	12.0%
Finance	11.7%

Notable threat actors

NoName057(16) pro-Russia hacktivist collective
UNC5221 China-nexus
Mustang Panda China-nexus
APT41 China-nexus
Flax Typhoon China-nexus

Year-over-year: figures for 2024 are still being transcribed from their source reports, so trend comparison will appear here once a second full year is available.