BRUSSELS — European governments are withholding too much information about cross-border cyberattacks, weakening the institutions built to coordinate the bloc’s defenses, the European Court of Auditors said Monday.
The auditors found that cooperation and investment had increased but that member states were still failing to report incidents promptly and consistently. The European Union has allocated €1.4 billion to cybersecurity in its current budget.
A gap exposed by an airport attack
The report pointed to a ransomware attack on an aviation-technology provider in September 2025 that disrupted airports in London, Brussels, Berlin, Dublin and elsewhere. None of the affected countries notified the EU cybersecurity agency or fellow states, according to the auditors.
National-security laws and divergent reporting practices can discourage governments from sharing sensitive details, even when an attack crosses borders. The result is a collective-action problem — each state may protect its own information, while every state loses access to warnings that could help contain the next incident.
No member has formally reported a “large-scale” cybersecurity incident since 2016, the auditors said, despite an EU definition that includes an attack affecting at least two countries.
Enforcement is moving to court
The findings arrive as the European Commission presses governments to incorporate common reporting duties into national law. In July, it referred France, Ireland, the Netherlands and Spain to the Court of Justice of the European Union over failures to transpose EU cybersecurity measures.
The audit does not itself impose penalties. It raises a governance question likely to shape future legislation — how to reconcile national-security secrecy with the speed and mutual trust required to defend interconnected infrastructure.
The gap between reporting law and operational trust
Europe has spent years building institutions for cyber cooperation, including national response teams and the EU cybersecurity agency. Those structures cannot coordinate a response if governments classify incidents differently, notify late or withhold the technical indicators that would allow another country to recognize the same attack.
National-security rules are part of the problem but not the whole of it. Agencies also worry about exposing vulnerabilities, admitting that critical systems failed or sharing information that could affect a criminal investigation. Companies may fear liability and reputational damage. The result is a system in which every participant has a reason to disclose less even though collective security depends on disclosure.
What useful reporting looks like
A bare notice that an incident occurred has limited value. Defenders need timely indicators of compromise, the affected supplier, the method of entry, containment steps and a reliable assessment of cross-border impact. That information must reach the people operating networks, not remain inside a policy channel.
The airport example is instructive because the immediate victim was a shared technology provider. Modern infrastructure depends on common vendors, so a single breach can propagate through airports, hospitals or public authorities in several countries before any government treats it as an EU-level event.
From audit findings to legal consequences
The European Court of Auditors does not impose fines or rewrite national law. Its findings can shape budget decisions, Commission enforcement and future amendments to incident-reporting rules. The pending infringement cases against four member states add judicial pressure by asking the Court of Justice to determine whether they failed to implement EU obligations.
A workable reform will need more than stricter deadlines. Governments need a protected channel, common classifications and rules governing how shared data may be used. Without those safeguards, a legal duty may produce defensive, low-value notices rather than candid operational cooperation.
The core lesson is that cybersecurity is now a problem of administrative law as well as engineering. Networks cross borders instantly; public authority and legal responsibility still stop at them.
