Poor Data Sharing Undermining EU Cyber Defences, Auditors Say

Efforts to combat cyberattacks across the European Union are being undermined by member states' failure to share enough information about cybersecurity incidents, the European Court of Auditors said on Monday.

The EU is investing heavily in cybersecurity, with around €1.4 billion allocated under its current budget, while cooperation between member states has expanded. However, auditors said the bloc's cybersecurity response was still not working as effectively as intended.

The auditors described poor information sharing as the “Achilles heel” of the EU's cybersecurity system, warning that timely and actionable information is essential when serious incidents occur. Without rapid exchanges of information, EU-wide networks and coordination mechanisms cannot provide their full benefit.

The report highlighted a ransomware attack against a technology provider serving the aviation industry in September 2025. The incident disrupted operations at airports in London, Brussels, Berlin, Dublin and other European hubs. According to the auditors, none of the affected member states notified the EU cybersecurity agency or other EU countries about the incident.

National security legislation is one of the obstacles. The auditors said individual countries' rules can make it difficult to share sensitive information when a cyberattack crosses borders. The report also noted that no EU member state has officially reported a “large-scale” cybersecurity incident since 2016, even though the designation applies to attacks affecting at least two member states.

The findings come as the EU continues building a more coordinated cybersecurity framework. The European Court of Auditors said overlapping systems and responsibilities can also reduce the effectiveness of the bloc's response, while enforcement of existing information-sharing requirements remains a major challenge.

In July, the European Commission referred France, Ireland, the Netherlands and Spain to the EU Court of Justice over their failure to fully incorporate European cybersecurity information-sharing measures into national law. The action underscores the continuing gap between EU-level requirements and implementation by individual governments.

The auditors' findings highlight a broader challenge for the EU: cyber threats increasingly cross national borders, while much of Europe's cybersecurity response remains organized at the national level. Improving the speed, quality and consistency of information sharing could therefore be critical to strengthening the bloc's ability to detect and respond to major cyber incidents.