Europe faces cyberattacks: Is it prepared?

Cyberattacks are surging across the European Union, targeting everything from government agencies to critical infrastructure. Despite numerous cybersecurity initiatives, the bloc struggles to defend itself effectively. The attacks exploit vulnerabilities in both technology and coordination, highlighting the need for a unified approach.

In Poland, cyberattacks rose by 145% between 2024 and 2025. In France, hackers stole sensitive data from over 600,000 taxpayers in July. In Berlin, a Russian-linked group held government data hostage, forcing system shutdowns. These incidents show the growing sophistication and frequency of attacks across the EU.

The threat is escalating as artificial intelligence enables attackers to enhance speed, scale, and sophistication. Ilias Bakatsis, a cybersecurity expert at the European Union Agency for Cybersecurity (ENISA), notes that AI is being used to refine phishing campaigns, reconnaissance, and malware development. AI also enables more convincing social engineering tactics, making attacks harder to detect.

AI’s Growing Role in Cyberattacks

The EU has shifted from a reactive to a proactive cybersecurity stance, focusing on prevention, preparedness, and coordinated response. However, defenses remain fragmented across borders and institutions, raising doubts about their ability to counter AI-driven attacks. This fragmentation is exacerbated by differing national priorities and resource allocation.

Europe’s vulnerability lies not just in the volume of attacks but in their targets. Public administrations, energy networks, and critical digital infrastructure are routinely compromised, endangering essential systems. The interconnectedness of these systems amplifies the potential impact of successful breaches.

Most incidents in the EU are ideologically driven, with hacktivists accounting for nearly 80% of recorded attacks between July 2024 and June 2025. Public administration bore the brunt, with 38% of incidents, while transport and logistics were also heavily targeted. These sectors are particularly vulnerable due to their reliance on interconnected digital systems.

State-aligned groups exploit supply-chain vulnerabilities and stolen software certificates to infiltrate telecommunications, manufacturing, and other networks, often operating covertly. Their tactics include long-term espionage and sabotage, posing a persistent threat to national security.

Fragmented Defenses and National Efforts

Defending Europe‘s critical infrastructure is daunting. In Germany, 50,000 organizations are classified as critical infrastructure, yet most lack the capacity to fend off advanced threats, according to Sven Herpig of the European tech think tank Interface. This gap highlights the need for targeted investment and capacity-building initiatives.

While U.S. AI models like Anthropic’s Mythos 5 and Fable 5 dominate headlines, experts like Herpig and Roeland Delrue of Aikido warn that low-cost, Chinese open-source models pose a more immediate threat. These models, just six to eight months behind their U.S. counterparts, can be stripped of security features and used to amplify attacks. Their accessibility lowers the barrier to entry for malicious actors.

The primary concern is the sheer volume of attacks rather than their sophistication. AI is accelerating the entire cyber kill chain, making operations faster but not necessarily more advanced. This acceleration increases the pressure on defenders to respond swiftly and effectively.

Related Post: Europe builds AI capabilities in three steps

The European Parliament’s Committee on Security and Defense (SEDE) advocates for enhanced detection, intelligence gathering, and response capabilities, including a new European cybersecurity center. MEP José Cepeda emphasizes the urgency of addressing threats from military AI and quantum computing. These emerging technologies could fundamentally alter the cybersecurity environment.

However, Europe’s existing coordination bodies face challenges due to governments’ reluctance to share critical information. Even within countries, agencies hesitate to collaborate, as Herpig points out. This reluctance stems from concerns over sovereignty and trust, complicating joint efforts.

Some nations, like the UK, Italy, and France, are bolstering their national cyber defenses through public-facing agencies with intelligence backgrounds. Joseph Jarnecki of the Royal United Services Institute sees potential in greater European cooperation, particularly in sharing vulnerability data and responding to strategic threats. Such cooperation could enhance collective resilience against cross-border threats.

Offensive Capabilities and Private Sector Challenges

The debate is shifting from defense to whether Europe should disrupt adversaries’ networks. Countries like France and Germany are expanding their offensive cyber capabilities, but recent attacks have exposed vulnerabilities in their basic security. This duality highlights the complexity of balancing offensive and defensive strategies.

A common European approach is complicated by differing political attitudes and the lack of unified systems and rules. Operations involving multiple countries are more likely to occur through NATO or smaller coalitions with shared technical and political commitments. These coalitions provide a more flexible framework for joint action.

A more immediate challenge is ensuring private companies can defend against ongoing attacks, including those enabled by AI. Cybercrime, particularly ransomware, remains a significant threat to European organizations. The private sector often lacks the resources and expertise to keep pace with evolving threats.

While companies are increasingly aware of the risks, many struggle to leverage AI beyond vulnerability detection. Delrue stresses the importance of basic cyber hygiene: retiring outdated systems, patching vulnerabilities, and using AI to scan critical infrastructure. These foundational practices are critical for building resilience.

The EU is tightening regulations, with proposed reforms to the Cybersecurity Act aiming to restrict technology from unfriendly nations in sensitive sectors like telecommunications. The revised NIS2 directive seeks to expand cybersecurity requirements and incident reporting. These measures aim to create a more robust regulatory framework.

Strengthening ENISA’s mandate and advancing the EU’s tech sovereignty push could bolster Europe’s cyber ecosystem. However, new laws alone won’t suffice if existing rules aren’t enforced and companies neglect fundamental security practices. Effective implementation and compliance are essential for success.

As Jarnecki notes, the key lies in empowering and resourcing regulators effectively, no matter how mundane it may seem. Without adequate support, even the best policies will fall short.