Europe is on high alert today, September 16, 2026, following a series of escalating cyber and sabotage threats targeting critical infrastructure across the continent. European leaders are calling for urgent action as the line between cybersecurity and national security blurs. This marks a significant escalation in hybrid warfare tactics, with energy grids, maritime and railway systems, and government platforms all identified as potential targets. The coordinated nature of these attacks suggests a sophisticated, possibly state-sponsored, campaign aimed at destabilizing the region.
EU Calls for Unified Defense Against Mounting Threats
European Commission President Ursula von der Leyen today called for the urgent creation of a new EU-wide security response mechanism. This mechanism is designed to address hybrid attacks that fall below the threshold of armed aggression but still pose a significant threat. Such threats include cyberattacks, the severing of undersea cables, and the protection of critical infrastructure. Von der Leyen stated that Europe urgently needs a consensus on how to respond to these incidents, which are increasingly occurring on EU soil. This proposal comes in the wake of numerous sabotage threats and drone incursions across Europe. Recent incidents in Denmark, Lithuania, and Poland, along with an attempted drone attack in Leipzig, have heightened concerns.
European Infrastructure Under Siege: A Growing Threat Landscape
The threat landscape has become increasingly volatile. Russia is identified as presenting the most imminent operational risk to European critical infrastructure. Confirmed OT-capable cyberattacks have targeted energy and water systems across EU member states. In June 2026 alone, attackers hit sectors including pharmaceuticals, higher education, government, gaming, and critical utilities. This included breaches at Novo Nordisk, disruptions at the University of Nottingham, and incidents affecting the Council of Europe and Nintendo.
These attacks are not isolated events. In March 2026, the European Commission itself was targeted in a sophisticated supply chain cyberattack involving the Trivy open-source security tool. This attack eventually affected approximately 30 EU entities and potentially exposed hundreds of gigabytes of sensitive data. The breach highlighted the vulnerability of interconnected digital supply chains. Similarly, in June 2026, critical maritime and railway infrastructures across Europe were simultaneously targeted in a coordinated cyberattack, causing severe operational disruptions. Port logistics, navigation systems, and railway networks were compromised, leading to halted cargo movements, safety risks, and delays for thousands of commuters.
Historical Precedents and Escalating Incidents
The current situation builds upon a pattern of escalating incidents. In January 2026, a criminal fire at a Berlin electrical site left over 100,000 people without power for days. In France, attacks in May 2025 cut electricity to 160,000 people for several hours. A massive blackout hit the Iberian Peninsula in April 2025, leaving millions without phones, internet, and payment systems for nearly 24 hours. In 2024, a Russian oil ship cut the cable between Finland and Estonia. Poland narrowly avoided a blackout by stopping a major cyberattack, with Russian-linked hackers being blamed. France’s cyber agency has described the threat as “particularly intense”.
The European Commission has also been a target of cyber incidents beyond the March 2026 supply chain attack. In January 2026, the Commission’s central infrastructure managing mobile devices identified traces of a cyber-attack that may have resulted in access to staff names and mobile numbers. While the incident was contained within nine hours and no compromise of mobile devices was detected, it underscored the persistent threat to EU institutions. In March 2026, the European Commission confirmed another cyberattack where attackers accessed the cloud infrastructure hosting its Europa.eu website, and some data was taken.
The New Cyber Resilience Act: Strengthening Defenses
In response to these growing threats, new regulations are being implemented. The EU’s Cyber Resilience Act (CRA) took effect on September 11, 2026. This act mandates that manufacturers of digital products sold in the EU must report actively exploited security vulnerabilities and serious cyber incidents within tight deadlines. Companies must submit an early warning within 24 hours of becoming aware of a vulnerability or incident, followed by a full notification within 72 hours. This applies to all products with digital elements, including hardware and software like baby monitors, smartwatches, apps, and computer programs. This legislation aims to strengthen the cybersecurity of these products and better protect consumers and businesses.
Furthermore, the European Commission proposed a comprehensive new cybersecurity package on January 20, 2026, aiming to strengthen the EU’s cybersecurity resilience. This package includes a proposal for a revised Cybersecurity Act (Cybersecurity Act 2.0) and amendments to the NIS2 Directive. A key element is a horizontal framework for trusted ICT supply chain security, addressing non-technical risks and potential foreign interference. High-risk suppliers would face significant restrictions, including exclusion from procurement procedures and EU funding programs.
Reactions and Expert Commentary
The urgency of the situation is widely recognized. NATO has called critical infrastructure a security priority and is pushing for more coordination and urgency in crisis readiness. James Appathurai, NATO’s top adviser on cyber and hybrid defenses, stated, “We are preparing for a much worse security environment. We need energy, the military needs energy, people need energy. Therefore it’s going to be in the sight lines”.
European leaders are actively seeking solutions. The proposed EU-wide security response mechanism could offer a solution when a state faces a significant security threat that is not clearly armed aggression. The Cyber Europe 2026 exercise, held on June 10-11, simulated realistic large-scale cybersecurity incidents affecting EU’s interconnected transportation systems, aiming to enhance cyber preparedness. Participants included national cybersecurity agencies, EU and EFTA public and private sectors, and EU entities.
What’s Next: A Preparedness Imperative
The coming months will be critical as Europe works to implement new security protocols and bolster its defenses against cyber threats. The focus is on enhancing preparedness, strengthening response capabilities, and ensuring the resilience of essential services. Investigations into the recent attacks are ongoing, with a particular emphasis on identifying perpetrators and understanding the full scope of the damage. The effectiveness of the new Cyber Resilience Act and the proposed emergency security protocol will be closely watched. Europe faces an evolving cybersecurity landscape, and a proactive, unified approach is deemed essential to safeguard its critical infrastructure and the well-being of its citizens.
For emergency cybersecurity assistance within the EU, please contact CERT-EU or your national cybersecurity agency.
This is a developing story. More information will be provided as it becomes available.
Social media verification status: Information regarding specific social media impacts is still being gathered.
Meta Description: Urgent: Europe on high alert as cyberattacks target critical infrastructure. EU leaders call for unified response to escalating hybrid threats and sabotage. Learn more.
