RESEARCH PREVIEW — Attention: Data Spaces may hack the planet.
Data Spaces

NATO (member states)

Analyse
Primarily a target — 92 received· 1 initiated· 13 responses ·Membership at the event date
Member countries over time

Membership is evaluated at each incident’s start date or response date. Countries that later left remain listed for historical records.

In the last 60 days, 93 new cyber operations involving NATO (member states) were added to the database: a 3% decrease compared to the previous period. The number of operations is currently 18% above the long-term 60-day average. The Intensity of cyber operations involving NATO (member states) over the last 60 days is rising to 3.5, compared with 3.2 in the preceding 60-day period. This is above the all-time average for NATO (member states) of 2.8.

Maintained by EuRepoC research analysts · updated 16 Oct 2026
92received initiated1
For last 60 days, this region appears chiefly as a target — 92 incidents directed at it, 1 it is linked to initiating.
Source: EuRepoC Global Database as of 16 Oct 2026.
01 / 02

Cyber activity

1 incident · as actor
As target 92 As actor 1

Operations EuRepoC links to actors based in NATO (member states), and the international responses they drew.

Cyber incident intensity
5.0/15
Mean5.0/15Elevated

Only one intensity value in this selection.

1 coded incident · Last 60 days
Database additions by weekincidents linked to NATO (member states)
Bar height shows incidents added during last 60 days; select a bar to filter this interval; hover for average intensity.
Most-targeted sectorswhat its operations hit
SectorIncidentsIntensityResponded
Government / ministries 1 5.0Elevated 1/1
Its operations concentrate on Government / ministries — 1 of 1 incidents.
By targetwho its operations hit
Australia 1incident avg 5.0 · Elevated
02 / 02

Operations initiated & responses drawn

DKDanish Civil Protection Agency Denmark Danish Civil Protection Agency Raised Cyber‑Threat Level to High because of Russia on 24 September 2026 Official policy 24 Sep 2026
Official policy 24 Sep 2026
DKDanish Civil Protection Agency Denmark
Danish Civil Protection Agency Raised Cyber‑Threat Level to High because of Russia on 24 September 2026
AUUSJPDE4 statesjoint WaterPlum Four International Partners Published Joint Security Advisory on North Korean Cyber Activities on 18 September 2026 Official policy 18 Sep 2026
Official policy 18 Sep 2026
AUUSJPDE4 states WaterPlum
Four International Partners Published Joint Security Advisory on North Korean Cyber Activities on 18 September 2026
NLGBUS3 statesjoint United Kingdom NCSC, United States FBI, and Netherlands AIVD Published Advisory on Iranian State‑Sponsored Spyware Campaign Targeting Dissidents on 15 September 2026 Technical disclosure 15 Sep 2026
Technical disclosure 15 Sep 2026
NLGBUS3 states
United Kingdom NCSC, United States FBI, and Netherlands AIVD Published Advisory on Iranian State‑Sponsored Spyware Campaign Targeting Dissidents on 15 September 2026
CACanadian Centre for Cyber Security Canada Canada Canadian Centre for Cyber Security (CCCS) Published a Statement Advising Canadian Organisations of AI‑Driven Attacks on Internet‑Exposed PLCs on 14 September 2026 Technical disclosure 14 Sep 2026
Technical disclosure 14 Sep 2026
CACanadian Centre for Cyber Security Canada
Canada Canadian Centre for Cyber Security (CCCS) Published a Statement Advising Canadian Organisations of AI‑Driven Attacks on Internet‑Exposed PLCs on 14 September 2026
USROHUBG4 statesjoint International Operation between US, Hungarian and Romanian Authorities, Supported by Europol, Disrupted the Sality Botnet on 31 August 2026 Operational action 31 Aug 2026
Operational action 31 Aug 2026
USROHUBG4 states
International Operation between US, Hungarian and Romanian Authorities, Supported by Europol, Disrupted the Sality Botnet on 31 August 2026
USFederal Bureau of Investigation Nanjing Xinjiuwei Network Technology Com… (China) US Justice Department and FBI Seized Platforms Operated by Chinese State-Sponsored Hackers "QTFY" to Target US Critical Infrastructure, 26 August 2026 Operational action 26 Aug 2026
Operational action 26 Aug 2026
USFederal Bureau of Investigation Nanjing Xinjiuwei Network Technology Com… (China)
US Justice Department and FBI Seized Platforms Operated by Chinese State-Sponsored Hackers "QTFY" to Target US Critical Infrastructure, 26 August 2026
USFederal Bureau of Investigation QTFY/QT/QTCYBER (China) US Federal Bureau of Investigation, National Security Agency, and Cyber National Mission Force Release Joint Advisory Warning of Ongoing Cyber Activity by China-Linked Threat Actor "QTFY", 26 August 2026 Official policy 26 Aug 2026
Official policy 26 Aug 2026
USFederal Bureau of Investigation QTFY/QT/QTCYBER (China)
US Federal Bureau of Investigation, National Security Agency, and Cyber National Mission Force Release Joint Advisory Warning of Ongoing Cyber Activity by China-Linked Threat Actor "QTFY", 26 August 2026
NONorwegian Digitalisation Agency Norway Norwegian Digitaliseringsdirektoratet Director Frode Danielsen Issues Statement Following DDoS Attack on Digdir's Digital Solutions on 25 August 2026 Operational action 25 Aug 2026
Operational action 25 Aug 2026
NONorwegian Digitalisation Agency Norway
Norwegian Digitaliseringsdirektoratet Director Frode Danielsen Issues Statement Following DDoS Attack on Digdir's Digital Solutions on 25 August 2026
Showing the 8 most recent of 14 Open all in advanced search
Search