ENISA’s 2026 threat report ranks public administration first among targeted EU sectors in 2025. It had 31.8% of recorded events. Business services (8.5%), transport (8%), manufacturing (6.9%) and finance/banking (5.6%) follow.
The ranking rests on 8,257 incidents recorded from 1 January to 31 December 2025. ENISA collected them mainly from open sources and from information shared by EU Member States.
How did ENISA build the 2025 sector ranking?
ENISA analysts collected and analyzed 8,257 incidents. Most came from open sources. ENISA also used anonymized information shared by EU Member States and by members of its Cyber Partnership Programme.
The reporting period is now the calendar year, so the report covers 1 January to 31 December 2025. The report is dated September 2026.
ENISA states a caveat. It says open sources and information shared voluntarily do not constitute a complete picture of cyber threats. Vague sector reporting, such as “private companies”, is likely to affect its dataset. ENISA adds that uneven reporting of how many EU organizations were hit notably affects the ranking of sectors and State-nexus intrusion sets.
ENISA also says essential and important entities represent 73% of recorded events. Member State reporting under NIS2 gives a different top five. It lists public administration, health, digital infrastructure, banking and transport.
ENISA attributes the gap to different scopes, thresholds and reporting conditions. That dataset holds 1,954 events reported in 2025, as of 14 July 2026.
- 8,257Incidents ENISA collected and analyzed for 1 January to 31 December 2025Source: ENISA 2026 report
- 31.8%Share of recorded events hitting public administration, the top sectorSource: ENISA 2026 report
- 73%Share of recorded events involving essential and important entitiesSource: ENISA 2026 report
- 1,954Events reported by Member States under NIS2 in 2025, as of 14 July 2026Source: ENISA 2026 report
1. Public administration: why is it the most targeted EU sector?
ENISA says public administration remains the most targeted sector, as in the previous report. Events mainly hit central entities (35.1%) and local entities (33.8%). Regional entities were at 10.1%.
ENISA cites its NIS360 report and places the sector in the cyber risk zone. There, criticality exceeds observed cybersecurity maturity.
The main driver was ideology-driven DDoS, which accounted for 81.8% of recorded incidents. Public-facing websites and portals were hit again and again. The attacks clustered around events such as law-enforcement takedowns and arrests, electoral processes, high visibility events and geopolitical tensions.
NoName057(16), Dark Storm Team and Mr. Hamza were the most active groups. ENISA says the reported impact remained largely limited to claimed or temporary disruption of public-facing websites.
Other threats were smaller. Among financially motivated incidents (8%), ransomware claims made up 36%, mainly affecting municipalities. A ransomware attack on a Swedish IT supplier affected around 200 municipalities and regional authorities.
Data breaches accounted for 38.4%. State-nexus groups showed a sustained focus on diplomatic and governmental entities for cyberespionage.
See our government and public sector page. Our incident library has recent public sector cases. They include a Dutch ministry breach, a Liechtenstein public register breach and a US agency contractor credential exposure.
2. Business services: what shaped the second place?
Business services were the second most impacted sector. Unauthorized access (56.7%) and DDoS attacks (38%) hit it most. Of the unauthorized accesses, ransomware deployments accounted for 54% and data breaches for 26.5%.
ENISA describes the sector as a broad set of entities outside NIS2. It includes consultancy firms, legal services, broadcast media and real estate services. Hospitality, consultancy and broadcast media made up 55.3% of events together.
Ideology-driven incidents were 47.3%. NoName057(16) was behind 35.8% of the claims (see our page on the NoName057(16) DDoS campaigns against Italy). Financially motivated incidents were 46.8%, and ransomware made up 65.4% of them.
ENISA uses a ransomware incident against a French wealth management software provider to show cascading effects. Disruption reportedly affected banks and wealth advisers for several days. That is the pattern described in our piece on supply chain cyber attacks.
State-nexus activity mainly took the form of DPRK-nexus job-themed campaigns. They aimed at software developers and consultancy-related profiles.
3. Transport: which subsectors and threats stood out?
Transport accounted for 8% of events. Targeting concentrated on railway (31.9%) and air (30.4%), then road (17.9%) and water transport (16.4%). Railway once accounted for only 2% of the sector’s events.
ENISA says repeated DDoS claims mainly drove the increase. They targeted railway, metro and tramway operators in H2 2025.
DDoS claims made up 83.1% of transport events, followed by unauthorized access (16.3%). ENISA says ideology-driven DDoS attacks (98.6%) were notably linked to specific national events in the EU and/or to support for Ukraine. NoName057(16) was behind 58% of the claims.
In June 2025, around the NATO Summit in The Hague, it claimed attacks against Dutch transport targets, including an airport in the Netherlands. EASA reported a 43.56% increase of hacktivist claims against European aviation websites.
Financially motivated incidents were 10.2% of the sector’s attacks. They split into data breaches (56.7%) and ransomware (37.3%). ENISA ties the breaches to exploitation of managed file-transfer software in logistics and supply-chain environments. It also ties them to attacks on third-party provider environments.
Based on EASA information, aviation saw at least 10 ransomware attacks in the EU in 2025. A September 2025 ransomware incident affected passenger-processing software. It disrupted automated check-in at several EU airports. More on aviation and travel.
4. Manufacturing: why do attackers go after it?
Manufacturing ranked fourth, at 6.9% of events. Incidents focused on machinery and equipment (23.3%) and construction (21.8%). Unauthorized access made up 80.4% of incidents and DDoS 14.6%.
Financially motivated incidents were 61.1% of the total, and ransomware deployments were 82.8% of those. ENISA reports that incidents continued to affect core IT systems. A few cases hit cross-site operations.
An incident at a German heat-exchanger manufacturer reportedly disrupted its subsidiaries in Poland and China. Current ransomware figures are in our Q2 2026 ransomware report.
Ideology-driven incidents were 24.2%, mostly DDoS (60.1%). NoName057(16) was behind 51.8% of DDoS claims. ENISA links the higher volume of unverified intrusion claims to increased targeting of operational technology.
State-nexus reports (8.4%) mainly concerned defense-related organizations. ENISA says it is plausible part of this activity was theft of intellectual property. See manufacturing.
5. Finance and banking: what made it a target?
Finance/banking accounted for 5.6% of events. Unauthorized access (46%) and DDoS attacks (38.9%) hit it most, then fraud and impersonation (14.8%). Member States reported that 10% of incidents with a significant impact in 2025 affected the banking sector. Credit institutions made up 61.9% of incidents, insurance 17.8% and crypto-asset service providers 7.7%.
ENISA says financial institutions process a lot of valuable data. That makes them high value targets for cybercriminals. Ideology-driven attacks were 40.6% of incidents, and 95.8% of those were DDoS claims.
NoName057(16) claimed 40.7% of those DDoS attacks. ENISA says the sector is highly likely to be valuable to hacktivists. A short website outage would affect several thousand customers.
Mainstream media would report it. State-nexus activity (2.8%) concerned crypto-asset service providers and high-value financial-sector personnel. See financial services.
How do the five sectors compare?
The table restates the chapters in one place. ENISA’s executive summary adds that sectoral analysis shows how the criticality of digital dependencies, sensitive data holdings and operational maturity shape exposure.
| Sector | Main incident type | What ENISA links to targeting |
|---|---|---|
| Public administration | Ideology-driven DDoS, 81.8% of incidents | Events such as elections and takedowns, and geopolitical tensions |
| Business services | Unauthorized access 56.7%, DDoS 38% | A broad sector outside NIS2, and ransomware |
| Transport | DDoS claims, 83.1% | Railway DDoS claims in H2 2025, and national events |
| Manufacturing | Unauthorized access, 80.4% | Ransomware, 82.8% of financially motivated incidents |
| Finance/banking | Unauthorized access 46%, DDoS 38.9% | Valuable data, and DDoS on public-facing portals |
What questions can a security team ask from this?
ENISA does not frame these as advice. They are checks derived from facts in its chapters.
- Which public-facing sites could a DDoS wave take down?ENISA says such sites were repeatedly targeted around specific events.
- Which suppliers would stop us if they were hit?A Swedish IT supplier incident affected around 200 municipalities and regional authorities.
- Where do we rely on file-transfer or third-party platforms?ENISA ties transport data breaches to managed file-transfer software.
- Is any operational technology reachable?ENISA links unverified intrusion claims to increased OT targeting.
Related reading: hacktivism and DDoS trends and the 2027 threat intelligence priorities.