ENISA’s Threat Landscape 2026 ranks public administration as the most targeted EU sector in 2025, at 31.8% of recorded events. Business services (8.5%), transport (8%), manufacturing (6.9%) and finance/banking (5.6%) follow. The ranking rests on 8,257 incidents recorded from 1 January to 31 December 2025, collected mainly from open sources and from information shared by EU Member States.
How did ENISA build the 2025 sector ranking?
ENISA analysts collected and analyzed 8,257 incidents, mainly from open sources, plus anonymized information shared by EU Member States. The reporting period is now the calendar year, so the report covers 1 January to 31 December 2025. The report is dated September 2026.
ENISA states a caveat. It says open sources and information shared voluntarily do not constitute a complete picture of the cyber threat landscape. Vague sector reporting, such as “private companies”, is likely to affect its dataset, and ENISA says this notably affects the ranking of sectors.
ENISA also says essential and important entities represent 73% of recorded events. Member State reporting under NIS2 gives a different top five: public administration, health, digital infrastructure, banking and transport. ENISA attributes the gap to different scopes, thresholds and reporting conditions. That dataset holds 1,954 events reported in 2025, as of 14 July 2026.
- 8,257Incidents ENISA collected and analyzed for 1 January to 31 December 2025Source: ENISA Threat Landscape 2026
- 31.8%Share of recorded events hitting public administration, the top sectorSource: ENISA Threat Landscape 2026
- 73%Share of recorded events involving essential and important entitiesSource: ENISA Threat Landscape 2026
- 1,954Events reported by Member States under NIS2 in 2025, as of 14 July 2026Source: ENISA Threat Landscape 2026
1. Public administration: why is it the most targeted EU sector?
ENISA says public administration remains the most targeted sector, as in the previous report. Events mainly hit central entities (35.1%) and local entities (33.8%), with regional entities at 10.1%. Citing its NIS360 report, ENISA places the sector in the cyber risk zone, where criticality exceeds observed cybersecurity maturity.
The main driver was ideology-driven DDoS, which accounted for 81.8% of recorded incidents. Public-facing websites and portals were repeatedly targeted around law-enforcement takedowns and arrests, electoral processes, high visibility events and geopolitical tensions. NoName057(16), Dark Storm Team and Mr. Hamza were the most active groups, and ENISA says the reported impact remained largely limited to claimed or temporary disruption of public-facing websites.
Other threats were smaller. Among financially motivated incidents (8%), ransomware claims made up 36%, mainly affecting municipalities. A ransomware attack on a Swedish IT supplier affected around 200 municipalities and regional authorities. Data breaches accounted for 38.4%, and State-nexus groups showed a sustained focus on diplomatic and governmental entities for cyberespionage. See our government and public sector page. Recent public sector cases in our incident library include the Dutch Ministry of Finance breach, the Liechtenstein beneficial owner register breach and the CISA contractor GitHub credential exposure.
2. Business services: what shaped the second place?
Business services were the second most impacted sector. They were mainly hit by unauthorized access (56.7%) and DDoS attacks (38%). Of the unauthorized accesses, ransomware deployments accounted for 54% and data breaches for 26.5%.
ENISA describes the sector as a broad set of entities outside NIS2, including consultancy firms, legal services, broadcast media and real estate services. Hospitality, consultancy and broadcast media together made up 55.3% of events. Ideology-driven incidents were 47.3%, with NoName057(16) behind 35.8% of the claims (see our page on the NoName057(16) DDoS campaigns against Italy). Financially motivated incidents were 46.8%, and ransomware made up 65.4% of them.
ENISA uses a ransomware incident against a French wealth management software provider to show cascading effects: disruption reportedly affected banks and wealth advisers for several days. That is the pattern described in our piece on supply chain cyber attacks. State-nexus activity mainly took the form of DPRK-nexus job-themed campaigns aimed at software developers and consultancy-related profiles.
3. Transport: which subsectors and threats stood out?
Transport accounted for 8% of events. Targeting concentrated on railway (31.9%) and air (30.4%), then road (17.9%) and water transport (16.4%). Railway once accounted for only 2% of the sector’s events. ENISA says the increase was mainly driven by repeated DDoS claims against railway, metro and tramway operators in H2 2025.
DDoS claims made up 83.1% of transport events, followed by unauthorized access (16.3%). ENISA says DDoS attacks conducted for ideology-driven purposes (98.6%) were notably linked to specific events at the EU national level or to support for Ukraine, and NoName057(16) was behind 58% of the claims. In June 2025, around the NATO Summit in The Hague, it claimed attacks against Dutch transport targets, including Schiphol airport. EASA reported a 43.56% increase of hacktivist claims against European aviation websites.
Financially motivated incidents were 10.2% of the sector’s attacks, split into data breaches (56.7%) and ransomware (37.3%). ENISA ties the breaches to exploitation of managed file-transfer software in logistics and supply-chain environments, and to attacks on third-party provider environments. Based on EASA information, aviation saw at least 10 ransomware attacks in the EU in 2025. A September 2025 ransomware incident affecting passenger-processing software disrupted automated check-in at several EU airports. More on aviation and travel.
4. Manufacturing: why do attackers go after it?
Manufacturing ranked fourth, at 6.9% of events. Incidents focused on machinery and equipment (23.3%) and construction (21.8%). Unauthorized access made up 80.4% of incidents and DDoS 14.6%.
Financially motivated incidents were 61.1% of the total, and ransomware deployments were 82.8% of those. ENISA reports that incidents continued to affect core IT systems, with a few cases hitting cross-site operations: an incident at a German heat-exchanger manufacturer reportedly disrupted its subsidiaries in Poland and China. Current ransomware figures are in our Q2 2026 ransomware report.
Ideology-driven incidents were 24.2%, mostly DDoS (60.1%), with NoName057(16) behind 51.8% of DDoS claims. ENISA links the higher volume of unverified intrusion claims to increased targeting of operational technology. State-nexus reports (8.4%) mainly concerned defense-related organizations, and ENISA says it is plausible part of this activity was theft of intellectual property. See manufacturing.
5. Finance and banking: what made it a target?
Finance/banking accounted for 5.6% of events. It was mainly hit by unauthorized access (46%) and DDoS attacks (38.9%), then fraud and impersonation (14.8%). Member States reported that 10% of incidents with a significant impact in 2025 affected the banking sector. Credit institutions made up 61.9% of incidents, insurance 17.8% and crypto-asset service providers 7.7%.
ENISA says financial institutions process a significant amount of valuable data, so they are high value targets for cybercriminals. Ideology-driven attacks were 40.6% of incidents, and 95.8% of those were DDoS claims, led by NoName057(16) (40.7%). ENISA says it is highly likely the sector is valuable to hacktivists because a short website outage would affect several thousand customers and be reported by mainstream media. State-nexus activity (2.8%) concerned crypto-asset service providers and high-value financial-sector personnel. See financial services.
How do the five sectors compare?
The table restates the chapters in one place. ENISA’s executive summary adds that sectoral analysis shows the criticality of digital dependencies, sensitive data holdings and operational maturity in shaping exposure.
| Sector | Main incident type | What ENISA links to targeting |
|---|---|---|
| Public administration | Ideology-driven DDoS, 81.8% of incidents | Events such as elections and takedowns, and geopolitical tensions |
| Business services | Unauthorized access 56.7%, DDoS 38% | A broad sector outside NIS2, and ransomware |
| Transport | DDoS claims, 83.1% | Railway DDoS claims in H2 2025, and national events |
| Manufacturing | Unauthorized access, 80.4% | Ransomware, 82.8% of financially motivated incidents |
| Finance/banking | Unauthorized access 46%, DDoS 38.9% | Valuable data, and DDoS on public-facing portals |
What questions can a security team ask from this?
ENISA does not frame these as advice. They are checks derived from facts in its chapters.
- Which public-facing sites could a DDoS wave take down?ENISA says such sites were repeatedly targeted around specific events.
- Which suppliers would stop us if they were hit?A Swedish IT supplier incident affected around 200 municipalities and regional authorities.
- Where do we rely on file-transfer or third-party platforms?ENISA ties transport data breaches to managed file-transfer software.
- Is any operational technology reachable?ENISA links unverified intrusion claims to increased OT targeting.
Related reading: hacktivism and DDoS trends and the 2027 threat intelligence priorities.