EU finance logged 3,383 major IT incidents in 2025. Most weren't cyber attacks.

On 3 June 2026 the three European Supervisory Authorities (ESAs) published their first annual report on major ICT incidents in EU finance [1]. These are the banking, insurance and securities regulators: the EBA, EIOPA and ESMA. The report covers 2025, the first year in which the Digital Operational Resilience Act (DORA) made such incidents reportable. It arrived as Europe went on holiday, and it got little coverage. It deserves more.

The headline is that hackers caused few of these incidents. Things broke. Half of all major incidents came from system failures, and almost a third came from problems at a supplier. For boards that is a disaster-recovery story more than a security one.

At a glance

• 3,383 major incidents in 2025, about 282 a month and 0.18 per regulated firm [1, p.9–10].
• Only about 10% were cybersecurity incidents. DDoS (33%) and data theft (31%) led, and ransomware hit insurers hardest [1, p.13–14].
• Half were caused by system failure or malfunction. External events caused 32%, process failures 19% and human error 12% [1, p.14–15].
• 29% started at a third-party provider, and a third crossed a border. In 8% of cases more than 10 countries were affected [1, p.12, 15].
• Two big events drove the peaks: the TARGET2 payments outage (27 February) and the Iberian blackout (28 April) [1, p.18–19].

The security picture

About 10% of major incidents were cyber-related, roughly 340 of 3,383 [1, p.13]. When firms said what the attacker did, two techniques made up nearly two-thirds of the answers [1, p.13–14]:

Shares for social engineering, ransomware and supply-chain are read from the report's Figure 6 and are approximate.

The ESAs read the low cyber share as a sign that defences are working. They also point to the EBA's own survey: 28% of banks had at least one successful attack that became a major incident, down from 35% [1, p.13, fn.16]. But they warn firms to keep raising their standards to "keep pace with" AI-driven attack tools [1, p.4].

There is a caution in that reading. DORA counts an incident only if it crosses impact thresholds, mostly downtime and the number of clients affected [1, p.12]. A quiet data theft that nobody has noticed yet causes no downtime, so it can sit below the bar. A low count of major cyber incidents is not the same as few intrusions.

The disaster-recovery picture

This is where the report is most useful.

1. A failover is not a recovery. On 27 February 2025, a core component of TARGET's storage system failed. The ESAs call the fault an "extremely rare hardware malfunction" [1, p.18]. TARGET is the European Central Bank (ECB) system that settles payments and securities in central-bank money. The Eurosystem switched to its secondary site, but then had to run full integrity checks before it could restart. T2 (payments) was down for about 10 hours and T2S (securities settlement) for about 8. Some salary and pension payments were late [1, p.18]. The secondary site worked. What took the time was proving the data could be trusted. Recovery time objectives that leave out data verification are too optimistic.

2. Your data centre staying up is not enough. In the Iberian blackout on 28 April 2025, Spain and Portugal were without power for about 10 hours. The data centres of major banks and insurers ran without a break on generators [1, p.18]. Customers still could not pay. Telecoms went down, branches lost power, and card terminals ran flat or lost their connection. Online banking was up, but customers had no internet to reach it [1, p.18–19]. Recovery plans that stop at the firm's own walls miss most of the chain the customer depends on.

3. One supplier, dozens of incidents. In banking, many small firms in a group share the same providers for core banking, payments and connectivity. The report calls the result a "multiplier effect": one failure can produce dozens of major incidents [1, p.10–11]. In 29% of all incidents the failure was on the supplier's side, and that includes suppliers not designated as critical [1, p.15]. Your continuity plan is only as strong as your provider's, and your provider may be everyone else's provider too.

4. Most outages are self-inflicted. System failures (50%), process failures (19%) and human error (12%) together far outweigh malicious action [1, p.14–15]. The ESAs point to change management, testing and resilience arrangements [1, p.19]. In practice, the riskiest moment for many firms is their own software release, not an attacker.

5. Nobody knows what recovery costs. Around 40% of incidents reported no cost at all, about 10% reported under €1,000, and 15% left the field blank [1, p.17]. The ESAs say this "may point to incorrect reporting practices", since staff time spent on an incident should be counted [1, p.17, fn.23]. Only about 3% reported any money recovered, for example from insurers or suppliers [1, p.18]. Without cost data, it is hard to build the case for spending on resilience.

Read the numbers with care

• This is year one. About 15% of incidents had no final report by the 5 February 2026 cut-off and are left out [1, p.7–8].
• Reporting still differs between sectors and countries. One market-data firm inflated its sector's count by applying the criteria differently for most of the year [1, p.11, fn.12].
• Banks and payment firms dominate (more than 60% and 16%), partly because they have reported incidents since 2018 under PSD2, the payments directive. The ESAs say the counts are not a risk ranking [1, p.10].

What it means for organisations

• Time the whole recovery. Measure failover plus integrity checks plus catch-up processing, not just the switch to the second site.
• Map the dependencies outside your walls. Include telecoms, power, card terminals, branches and how customers reach you. Test what happens when those fail and your systems don't.
• Know who else shares your suppliers. Ask critical providers how they would recover if they failed across many clients at once. DORA's Register of Information, which records firms' IT supplier contracts, is meant to help supervisors see these concentrations [1, p.20].
• Treat change management as a resilience control. Most major incidents begin inside the firm.
• Record incident costs properly, including staff time. It is a DORA requirement, and it is the evidence you need for resilience budgets.
• Don't take the low cyber share as comfort. Watch for attacks that steal data quietly, without causing downtime.

Sources

1. Joint Committee of the ESAs, 2025 Report on major ICT-related incidents (JC 2026 16), 3 June 2026. ESMA: https://www.esma.europa.eu/document/esas-2025-report-major-ict-related-incidents · EIOPA: https://www.eiopa.europa.eu/publications/esas-joint-report-major-ict-related-incidents-2025_en · PDF: https://www.esma.europa.eu/sites/default/files/2026-06/JC_2026_16_ESAs_2025_report_on_major_ICT-related_incidents.pdf