European Court of Auditors: Poor Data Sharing Undermines EU Cyber Defenses

The European Court of Auditors said on Monday that efforts to combat cyberattacks across the European Union are being undermined by member states’ failure to share enough information about incidents.

The 27-member bloc was investing ever more in cybersecurity – €1.4 billion in its current budget – and improving cooperation, according to the court, which reports on how effectively the EU spends its money. But it was not working as well as it should, it added.

“Poor information sharing was the Achilles’ heel of the entire system,” the report said.

It cited a ransomware attack on a technology provider for the aviation industry in September 2025 that disrupted airports in London, Brussels, Berlin, Dublin and other hubs.

None of the affected states notified the EU’s cybersecurity agency or other members about the incident, the report said.

Individual countries’ national security legislation was getting in the way when countries needed to share information about cross-border incidents, the court said.

No EU state has reported a “large-scale” cybersecurity incident since 2016, even though that label officially applies to any attack affecting at least two members, it added.

In July, the European Commission referred France, Ireland, the Netherlands and Spain to the EU Court of Justice for failing to adapt their national laws to include EU measures on cybersecurity information sharing.