RESEARCH PREVIEW — Attention: Data Spaces may hack the planet.
Data Spaces

NATO (member states)

Analyse
Primarily a target — 379 received· 7 initiated· 147 responses ·Membership at the event date
Member countries over time

Membership is evaluated at each incident’s start date or response date. Countries that later left remain listed for historical records.

This year to date, 381 new cyber operations involving NATO (member states) were added to the database: a 3% increase compared to the previous period. The number of operations is currently 7% below the long-term year-to-date average. The Intensity of cyber operations involving NATO (member states) over this year to date is declining to 3.2, compared with 3.3 in the same elapsed span of the previous year. This is above the all-time average for NATO (member states) of 2.8.

Maintained by EuRepoC research analysts · updated 16 Oct 2026
379received initiated7
For this year to date, this region appears chiefly as a target — 379 incidents directed at it, 7 it is linked to initiating.
Source: EuRepoC Global Database as of 16 Oct 2026.
01 / 02

Cyber activity

7 incidents · as actor
As target 379 As actor 7

Operations EuRepoC links to actors based in NATO (member states), and the international responses they drew.

Cyber incident intensity
Mean4.4/15Moderate
Range 3.0–5.0

Drag the ends of the observed range to narrow intensities.

5 coded incidents · This year to date
Database additions by monthincidents linked to NATO (member states)
Bar height shows incidents added during this year to date; select a bar to filter this interval; hover for average intensity.
Most-targeted sectorswhat its operations hit
SectorIncidentsIntensityResponded
Corporate Targets 3 2.7Moderate 0/3 Government / ministries 1 5.0Elevated 1/1 Civil service / administration 1 3.0Moderate 0/1 Criminal 1 4.0Moderate 1/1 Judiciary 1 0.0Moderate 0/1 Energy 1 5.0Elevated 0/1
Its operations concentrate on Corporate Targets — 3 of 7 incidents.
By targetwho its operations hit
United States 2incidents avg 1.5 · Moderate Australia 1incident avg 5.0 · Elevated France 1incident avg 5.0 · Elevated Russia 1incident avg 4.0 · Moderate United Kingdom 1incident avg 0.0 · Moderate Spain 1incident avg 5.0 · Elevated
02 / 02

Operations initiated & responses drawn

DKDanish Civil Protection Agency Denmark Danish Civil Protection Agency Raised Cyber‑Threat Level to High because of Russia on 24 September 2026 Official policy 24 Sep 2026
Official policy 24 Sep 2026
DKDanish Civil Protection Agency Denmark
Danish Civil Protection Agency Raised Cyber‑Threat Level to High because of Russia on 24 September 2026
AUUSJPDE4 statesjoint WaterPlum Four International Partners Published Joint Security Advisory on North Korean Cyber Activities on 18 September 2026 Official policy 18 Sep 2026
Official policy 18 Sep 2026
AUUSJPDE4 states WaterPlum
Four International Partners Published Joint Security Advisory on North Korean Cyber Activities on 18 September 2026
NLGBUS3 statesjoint United Kingdom NCSC, United States FBI, and Netherlands AIVD Published Advisory on Iranian State‑Sponsored Spyware Campaign Targeting Dissidents on 15 September 2026 Technical disclosure 15 Sep 2026
Technical disclosure 15 Sep 2026
NLGBUS3 states
United Kingdom NCSC, United States FBI, and Netherlands AIVD Published Advisory on Iranian State‑Sponsored Spyware Campaign Targeting Dissidents on 15 September 2026
CACanadian Centre for Cyber Security Canada Canada Canadian Centre for Cyber Security (CCCS) Published a Statement Advising Canadian Organisations of AI‑Driven Attacks on Internet‑Exposed PLCs on 14 September 2026 Technical disclosure 14 Sep 2026
Technical disclosure 14 Sep 2026
CACanadian Centre for Cyber Security Canada
Canada Canadian Centre for Cyber Security (CCCS) Published a Statement Advising Canadian Organisations of AI‑Driven Attacks on Internet‑Exposed PLCs on 14 September 2026
USROHUBG4 statesjoint International Operation between US, Hungarian and Romanian Authorities, Supported by Europol, Disrupted the Sality Botnet on 31 August 2026 Operational action 31 Aug 2026
Operational action 31 Aug 2026
USROHUBG4 states
International Operation between US, Hungarian and Romanian Authorities, Supported by Europol, Disrupted the Sality Botnet on 31 August 2026
USFederal Bureau of Investigation Nanjing Xinjiuwei Network Technology Com… (China) US Justice Department and FBI Seized Platforms Operated by Chinese State-Sponsored Hackers "QTFY" to Target US Critical Infrastructure, 26 August 2026 Operational action 26 Aug 2026
Operational action 26 Aug 2026
USFederal Bureau of Investigation Nanjing Xinjiuwei Network Technology Com… (China)
US Justice Department and FBI Seized Platforms Operated by Chinese State-Sponsored Hackers "QTFY" to Target US Critical Infrastructure, 26 August 2026
USFederal Bureau of Investigation QTFY/QT/QTCYBER (China) US Federal Bureau of Investigation, National Security Agency, and Cyber National Mission Force Release Joint Advisory Warning of Ongoing Cyber Activity by China-Linked Threat Actor "QTFY", 26 August 2026 Official policy 26 Aug 2026
Official policy 26 Aug 2026
USFederal Bureau of Investigation QTFY/QT/QTCYBER (China)
US Federal Bureau of Investigation, National Security Agency, and Cyber National Mission Force Release Joint Advisory Warning of Ongoing Cyber Activity by China-Linked Threat Actor "QTFY", 26 August 2026
NONorwegian Digitalisation Agency Norway Norwegian Digitaliseringsdirektoratet Director Frode Danielsen Issues Statement Following DDoS Attack on Digdir's Digital Solutions on 25 August 2026 Operational action 25 Aug 2026
Operational action 25 Aug 2026
NONorwegian Digitalisation Agency Norway
Norwegian Digitaliseringsdirektoratet Director Frode Danielsen Issues Statement Following DDoS Attack on Digdir's Digital Solutions on 25 August 2026
Showing the 8 most recent of 154 Open all in advanced search
Search