Poor data sharing undermining EU cyber defences

Efforts to combat ⁠cyberattacks ⁠across the European Union are being undermined by member states' failure to share enough information on the incidents, the European Court of ‌Auditors said.

The 27-nation bloc ‌was ‌investing more and more in ‌cyber security — with €1.4 billion ($2.25 billion) in ⁠its current budget — and improving cooperation, according to the court, which reports on how effectively the EU spends money.

But this was not working ​as well as it should, it added.

Poor information sharing was the "Achilles heel of ⁠the entire system", the report said.    

"When a serious cyber incident occurs, timely and actionable information is essential. Without it, networks and mechanisms lose much of their added value," it added.

It pointed to a ransomware attack on a technology provider for the aviation industry in September 2025, which ​disrupted airports in London, Brussels, ⁠Berlin, Dublin and other hubs. 

None of ⁠the affected states notified the EU cybersecurity agency or other members ​of the incident, the report said.

Individual countries' national ‌security legislation ⁠was getting in the way when countries needed to share information about incidents that crossed borders, the court said.

No ‌EU state has reported a "large-scale" cybersecurity incident since 2016, even though that label officially applies to any attack affecting at least two members, ​it added.    

In July, the European Commission referred France, Ireland, the Netherlands and Spain to the EU Court of Justice for ‌failing to ⁠adjust their national laws ​to include EU measures on sharing cyber security information.