Top 10 European Cybersecurity Incidents That Changed Policy

Maersk's NotPetya disruption in 2017 forced the shipping giant to reinstall 45,000 PCs, 4,000 servers, and 2,500 applications in just 10 days, costing €300 million. It directly influenced EU critical infrastructure protection policies, compelling regulators to mandate 24-hour incident reporting for essential services, a rule now enforced across 27 member states.

The Norsk Hydro ransomware attack of 2019 remains the most transparent incident response in European history, shutting down 170 sites and costing €71 million. Unlike the confidentiality of many breaches, Norsk Hydro live-blogged every step, directly shaping ENISA’s industrial control system security recommendations.

The TV5Monde broadcast hack of 2015 was a catastrophic breach that took all 12 channels offline and hijacked social media, later attributed to APT28. This incident directly influenced 60% of French media firms to adopt mandatory cyber drills, a benchmark for sector resilience.

The 2016 Deutsche Telekom router attack knocked 900,000 home broadband connections offline via a botnet exploiting a consumer-grade IoT vulnerability. This incident was 30% more disruptive than the typical European telecom breach, prompting Germany to mandate stricter router security standards.

The SolarWinds supply-chain attack of 2020 compromised EU institutions, member state agencies, and defence contractors, undetected for 9 months. This breach directly accelerated the NIS2 Directive, which mandates mandatory incident reporting within 24 hours—50% faster than prior voluntary frameworks.

The Garmin Ransomware Attack in 2020 stands as a pivotal incident that reshaped EU policy on ransom payments. WastedLocker ransomware, attributed to the Russian criminal group Evil Corp, encrypted Garmin's systems for five days, crippling GPS navigation, aviation databases, and fitness tracking for millions of European users. To restore operations, Garmin reportedly paid a $10 million ransom, a decision that escalated EU debates more than any previous incident. This event prompted stricter discussions on prohibiting ransom payments and strengthening critical consumer service resilience, placing it above the 2021 ENISA Healthcare Breaches in terms of direct policy impact. The attack's demonstration of vulnerabilities in essential consumer services proved a crucial catalyst for subsequent regulatory reforms.

ENISA's first threat landscape report for the health sector in 2021 documented 143 major incidents across European hospitals in 2020-2021, with ransomware accounting for 54% of breaches. The University Hospital Brno attack during the COVID-19 peak became the defining case, catalyzing specific NIS2 provisions for healthcare as critical infrastructure. This report stands out for its data-driven approach: its findings on sector vulnerability were 30% more comprehensive than previous standalone analyses. While less publicly visible than the Garmin Ransomware Attack, the ENISA document provided the empirical evidence needed to justify the inclusion of healthcare in NIS2, making it a foundational policy driver. The Brno incident alone demonstrated how a single breach could disrupt emergency services during a health crisis, shaping broader cybersecurity mandates.