RESEARCH PREVIEW — Attention: Data Spaces may hack the planet.
Data Spaces

NATO (member states)

Analyse
Primarily a target — 2613 received· 188 initiated· 544 responses ·Membership at the event date
Member countries over time

Membership is evaluated at each incident’s start date or response date. Countries that later left remain listed for historical records.

Across the full record, 2685 cyber operations involving NATO (member states) were added to the database. The all-time mean Intensity of cyber operations involving NATO (member states) is 2.8.

Maintained by EuRepoC research analysts · updated 16 Oct 2026
2613received initiated188
For all time, this region appears chiefly as a target — 2613 incidents directed at it, 188 it is linked to initiating.
Source: EuRepoC Global Database as of 16 Oct 2026.
01 / 02

Cyber activity

188 incidents · as actor
As target 2613 As actor 188

Operations EuRepoC links to actors based in NATO (member states), and the international responses they drew.

Cyber incident intensity
Mean2.3/15Moderate
Range 1.0–9.0

Drag the ends of the observed range to narrow intensities.

185 coded incidents · All time
Database additions by yearincidents linked to NATO (member states)
Bar height shows incidents added during all time; select a bar to filter this interval; hover for average intensity.
Most-targeted sectorswhat its operations hit
SectorIncidentsIntensityResponded
Government / ministries 38 1.9Moderate 7/38 Corporate Targets 30 2.3Moderate 5/30 Civil service / administration 21 2.3Moderate 10/21 Telecommunications 18 2.4Moderate 2/18 End user(s) / specially protected groups 18 2.7Moderate 3/18 Media 15 1.7Moderate 1/15 State institutions / political system 11 1.9Moderate 0/11 Transportation 9 3.1Moderate 4/9
Its operations concentrate on Government / ministries — 38 of 188 incidents.
By targetwho its operations hit
United States 42incidents avg 1.9 · Moderate Turkey 32incidents avg 2.1 · Moderate China 24incidents avg 2.2 · Moderate Russia 20incidents avg 2.3 · Moderate Spain 18incidents avg 2.5 · Moderate Germany 18incidents avg 2.1 · Moderate Iran 17incidents avg 2.2 · Moderate Netherlands 16incidents avg 2.4 · Moderate
Showing 8 of 190
02 / 02

Operations initiated & responses drawn

DKDanish Civil Protection Agency Denmark Danish Civil Protection Agency Raised Cyber‑Threat Level to High because of Russia on 24 September 2026 Official policy 24 Sep 2026
Official policy 24 Sep 2026
DKDanish Civil Protection Agency Denmark
Danish Civil Protection Agency Raised Cyber‑Threat Level to High because of Russia on 24 September 2026
AUUSJPDE4 statesjoint WaterPlum Four International Partners Published Joint Security Advisory on North Korean Cyber Activities on 18 September 2026 Official policy 18 Sep 2026
Official policy 18 Sep 2026
AUUSJPDE4 states WaterPlum
Four International Partners Published Joint Security Advisory on North Korean Cyber Activities on 18 September 2026
NLGBUS3 statesjoint United Kingdom NCSC, United States FBI, and Netherlands AIVD Published Advisory on Iranian State‑Sponsored Spyware Campaign Targeting Dissidents on 15 September 2026 Technical disclosure 15 Sep 2026
Technical disclosure 15 Sep 2026
NLGBUS3 states
United Kingdom NCSC, United States FBI, and Netherlands AIVD Published Advisory on Iranian State‑Sponsored Spyware Campaign Targeting Dissidents on 15 September 2026
CACanadian Centre for Cyber Security Canada Canada Canadian Centre for Cyber Security (CCCS) Published a Statement Advising Canadian Organisations of AI‑Driven Attacks on Internet‑Exposed PLCs on 14 September 2026 Technical disclosure 14 Sep 2026
Technical disclosure 14 Sep 2026
CACanadian Centre for Cyber Security Canada
Canada Canadian Centre for Cyber Security (CCCS) Published a Statement Advising Canadian Organisations of AI‑Driven Attacks on Internet‑Exposed PLCs on 14 September 2026
USROHUBG4 statesjoint International Operation between US, Hungarian and Romanian Authorities, Supported by Europol, Disrupted the Sality Botnet on 31 August 2026 Operational action 31 Aug 2026
Operational action 31 Aug 2026
USROHUBG4 states
International Operation between US, Hungarian and Romanian Authorities, Supported by Europol, Disrupted the Sality Botnet on 31 August 2026
USFederal Bureau of Investigation Nanjing Xinjiuwei Network Technology Com… (China) US Justice Department and FBI Seized Platforms Operated by Chinese State-Sponsored Hackers "QTFY" to Target US Critical Infrastructure, 26 August 2026 Operational action 26 Aug 2026
Operational action 26 Aug 2026
USFederal Bureau of Investigation Nanjing Xinjiuwei Network Technology Com… (China)
US Justice Department and FBI Seized Platforms Operated by Chinese State-Sponsored Hackers "QTFY" to Target US Critical Infrastructure, 26 August 2026
USFederal Bureau of Investigation QTFY/QT/QTCYBER (China) US Federal Bureau of Investigation, National Security Agency, and Cyber National Mission Force Release Joint Advisory Warning of Ongoing Cyber Activity by China-Linked Threat Actor "QTFY", 26 August 2026 Official policy 26 Aug 2026
Official policy 26 Aug 2026
USFederal Bureau of Investigation QTFY/QT/QTCYBER (China)
US Federal Bureau of Investigation, National Security Agency, and Cyber National Mission Force Release Joint Advisory Warning of Ongoing Cyber Activity by China-Linked Threat Actor "QTFY", 26 August 2026
NONorwegian Digitalisation Agency Norway Norwegian Digitaliseringsdirektoratet Director Frode Danielsen Issues Statement Following DDoS Attack on Digdir's Digital Solutions on 25 August 2026 Operational action 25 Aug 2026
Operational action 25 Aug 2026
NONorwegian Digitalisation Agency Norway
Norwegian Digitaliseringsdirektoratet Director Frode Danielsen Issues Statement Following DDoS Attack on Digdir's Digital Solutions on 25 August 2026
Showing the 8 most recent of 731 Open all in advanced search
Search