EU auditors warn that weak data sharing hampers bloc cyber defence

The European Court of Auditors highlighted that inadequate sharing of cyber-attack data among EU members is eroding the bloc's defensive capabilities, despite a growing €1.4 billion budget for cybersecurity. The audit points to a ransomware incident in September 2025 that crippled airport operations in London, Brussels, Berlin, Dublin and other hubs, noting that none of the impacted nations notified the EU cybersecurity agency or each other.

National security legislation in individual countries is identified as a barrier to cross-border information flow. The report also observes that no EU state has recorded a "large-scale" cyber incident—defined as affecting at least two members—since 2016. In July, the European Commission referred France, Ireland, the Netherlands and Spain to the EU Court of Justice for not aligning national laws with EU information-sharing rules. The auditors warned that without timely, actionable data, the EU's coordinated response mechanisms lose much of their value.