Cyberattacks: Why Can’t the European Union (Still) Agree on a Common Response?

The recent cyberattack targeting refrigeration systems in hundreds of supermarkets across France demonstrated just how far hackers are now prepared to go. The attack reportedly cost the retail sector tens of millions of euros.

In its report on the detection of and response to major cyber incidents, presented on September 21, the European Court of Auditors [1] described the EU’s response to cyberattacks as “partially effective”. The auditors highlighted the “limited” exchange of information between the 27 Member States, which undermines the EU’s cybersecurity. “Under these circumstances, Member States may fail to realise that they are facing the same attack and, consequently, be unable to coordinate their response,” the report notes.

“We are still operating under the assumption that reporting an incident amounts to admitting vulnerability,” observes Loïc Guézo, Vice-President of CLUSIF and Director of Strategy at US cybersecurity company Proofpoint [2]. “As long as this perception of weakness prevails, the natural reaction will be to retreat and refuse to share information. Tensions still exist between European neighbours. The CSIRT community (Computer Security Incident Response Teams) has reached that level of maturity, but Member States have not.”

Containment Takes Priority Over Reporting

The framework already exists, with a network of CSIRTs, a cyber crisis management network known as EU-CyCLONe [3], and a cybersecurity reserve backed by €36 million for the 2025–2027 period. Yet Member States appear reluctant to make full use of these resources.

For Andy Garth, spokesperson for Slovak cybersecurity company ESET, the findings come as no surprise. “Cybersecurity remains primarily a national responsibility,” he acknowledges. “In the midst of a cyber crisis, organisations prioritise containment and service restoration over reporting and coordination.”

Yet when a serious cyber incident occurs, timely access to actionable information is essential, stresses George-Marius Hyzler [4], one of the report’s authors. “Without it, networks and mechanisms lose much of their added value.” The Court also points out that NIS2 has still not been transposed into national law by all Member States, including France, nearly two years after the deadline expired.

According to the auditors, these delays have a significant impact on information sharing. “As long as the directive has not been transposed, thousands of entities across the 18 sectors covered by NIS2 are not legally required to report incidents,” the Luxembourg-based institution regrets. Among these entities are public administration bodies, the most frequently targeted sector in the EU according to the European Union Agency for Cybersecurity’s (ENISA) 2025 Threat Landscape report [5]. “The Commission has launched infringement proceedings against Member States that are lagging behind,” a spokesperson told us.

The audit also found that the European warning system intended to connect EU-funded cross-border cyber hubs was not operational at the time of the assessment. The two hubs examined, ATHENA and ENSOC, had not yet begun operating because their public procurement procedures had not been completed.
“Obstacles may arise from differences in national interpretations, varying levels of maturity and capabilities, resource constraints, or challenges related to trust, particularly in the context of ongoing investigations,” confirms Hans De Vries [6], ENISA’s Chief Operating Officer (COO) for cybersecurity and operations.

Ultimately, however, the final decision remains in the hands of Member States.

Incidents That Go Unreported at European Level

To illustrate its findings, the report cites the September 2025 ransomware attack against technology provider Collins Aerospace. Baggage handling at airports in Brussels, London and Berlin had to be carried out manually, resulting in widespread delays and flight cancellations. Yet no Member State classified the incident as significant at the cross-border level, preventing the activation of EU-wide coordination mechanisms. “It would be useful to assess where decision-making processes could be facilitated, particularly when decisions are required at higher levels,” suggests De Vries.

Despite the EU’s adoption of yet another framework, the Cyber Solidarity Act [7], a European regulation that entered into force in early 2025, the Court regrets that “there is no EU-wide platform that centralises incident reports from all Member States in real time”. For its part, CERT-EU [8] told us that it “takes note of these observations, particularly the importance of promoting a culture of information sharing within the network”. The organisation is calling for close cooperation between the public sector, private companies and academia.

The need for action is pressing. Cybersecurity has become a constant race against attackers. “Even if a system is established at a given level at a particular point in time, the threat will continue to evolve and accelerate with AI,” Guézo points out. “The system must be continuously improved and adapted.” Some challenges remain, De Vries acknowledges. “These include clearly defining roles and procedures, ensuring rapid information sharing, and guaranteeing effective coordination based on trust and preparedness.”

Whether the EU can deliver on these ambitions remains to be seen.

Key Takeaways

1. Insufficient European cooperation in the face of cyberattacks. According to the European Court of Auditors, the 27 Member States share too little information about cyber incidents, undermining their ability to coordinate an effective response.
2. European cybersecurity mechanisms are struggling to become fully operational. Despite existing structures and funding, their effectiveness is hampered by delays in transposing the NIS2 Directive into national law.
3. A pressing need for cultural change and stronger coordination. The EU must build genuine trust between Member States, accelerate incident reporting and clarify responsibilities to improve its collective response to cyber threats.

Sources and References

1. European Court of Auditors
2. Proofpoint
3. EU-CyCLONe
4. George-Marius Hyzler
5. ENISA Threat Landscape 2025
6. ENISA – The Executive Director
7. Cyber Solidarity Act
8. CERT-EU