Today, Europe is faced with the largest outbreak of cyber-attacks ever recorded. From hospitals and schools to energy grids and small businesses, digital criminals are striking with increasing frequency, exploiting artificial intelligence, security gaps and geopolitical tensions to wreak havoc and extract profits.

This is the central conclusion of the “Microsoft Digital Defense Report 2025”, which outlines a Europe under constant siege. According to the report, 50% of attacks are financially motivated, mainly through ransomware and extortion, while espionage accounts for just 4% of incidents.

According to the report’s findings, data eavesdropping is now the norm: in 80% of attacks, perpetrators aim to collect or leak sensitive information. As the authors of the research note, attacks are becoming increasingly complex. With the help of artificial intelligence, cybercriminals create deepfakes, launch sophisticated phishing scams and automate large-scale attacks.

New techniques, such as “ClickFix”, where the user unknowingly executes malicious code and device code phishing, are spreading rapidly in Europe. At the same time, cloud environments remain vulnerable as organizations delay security updates.

Geopolitical dimension

The geopolitical dimension of cyber-attacks is particularly intense. Russian groups target government organizations and small and medium-sized businesses in countries that support Ukraine, with 25% of attacks outside of Ukraine targeting NATO member states.

At the same time, Iranian groups are hitting European logistics and shipping companies – Greece is among the countries affected – while China and North Korea are targeting universities, technology institutes and government agencies.

According to the report’s observations, in the face of this threat, the European Union is responding with the Cyber ​​Resilience Act (CRA), the new institutional framework, which aspires to be for cybersecurity what the GDPR was for data protection. Microsoft is actively participating in the European effort, providing real-time threat intelligence to EU governments and helping shape CRA compliance standards.

“Resilience and public-private cooperation are the cornerstone of the European strategy. The EU is investing in intelligence sharing, joint security initiatives and the protection of critical infrastructure, from energy to transport,” research highlights.

Protection measures

In terms of what organizations and citizens can do, the report recommends:

  • Implement multi-factor authentication (MFA).
  • Software update and proactive vulnerability management.
  • Staff training and safety culture cultivation.
  • Compliance with the new European standards (CRA, AI Act).
  • Participation in information sharing networks.