# EU Allocated €1.4bn for Cybersecurity. An Airport Ransomware Attack Triggered No Cross-Border Alert.

Published: 2026-11-01

For wider context, Factrail tracks the relevant decision makers and the public consequences through [ursula von der leyen](https://factrail.ai/people/ursula-von-der-leyen), [energy security](https://factrail.ai/drivers/energy-security), and [fiscal policy sustainability](https://factrail.ai/drivers/fiscal-policy-sustainability). These references provide context rather than proof of a specific legal or financial claim.

# EU Allocated €1.4bn for Cybersecurity. An Airport Ransomware Attack Triggered No Cross-Border Alert.

Factrail investigation | European Union | Audit published 21 September 2026 | Research cut-off: 1 November 2026

The finding. Europe's cybersecurity failure in a major 2025 airport disruption was not a shortage of institutions. It was a failure to make national incident information reach them. The European Court of Auditors reported in September 2026 that none of the affected member states formally notified the EU's cybersecurity agency or other member states of the Collins Aerospace ransomware disruption, even though the attack interfered with airport operations in several countries. The CSIRTs network did not escalate it to the EU's cyber-crisis coordination network. At the same time, the EU had allocated €1.4 billion to cybersecurity within its 2021-2027 Digital Europe budget, but its new cross-border alert hubs were not operational at the audit cut-off and the auditors found weaknesses in checks on grant recipients' ownership and performance. These are documented failures of coordination and control, not evidence that €1.4 billion was stolen or spent without benefit. The crucial accountability question is which institution could compel reporting, finish the systems and prove that public money purchased usable resilience. [Primary audit, paragraphs 4, 8-23 and 31-44](https://www.eca.europa.eu/ECAPublications/SR-2026-19/SR-2026-19_EN.pdf).

## A real airport disruption, but no formal European escalation

In September 2025 a ransomware attack affected Collins Aerospace passenger-processing software used at European airports. Independent contemporaneous [Reuters reporting](https://www.reuters.com/business/aerospace-defense/eu-agency-says-third-party-ransomware-behind-airport-disruptions-2025-09-22/) and the [Associated Press account](https://apnews.com/article/4eb95c1157cf34b606e021088256d20a) describe cancelled flights, queues and manual check-in workarounds in Brussels, Berlin and London, with Dublin also affected. The parent company RTX and its Collins unit were dealing with a cyber incident; the public record cited here does not establish who directed the attack. The AP reported that air-traffic control and aviation safety were unaffected, a meaningful limit on any suggestion that the episode was a continent-wide aviation safety emergency.

The [European Court of Auditors' Special Report 19/2026](https://www.eca.europa.eu/ECAPublications/SR-2026-19/SR-2026-19_EN.pdf), paragraph 38 and Box 1, supplies a different, later finding: none of the affected member states classified the episode as a significant or large-scale cross-border incident for the purpose of formally notifying ENISA or other member states. Consequently the network of computer security incident response teams, or CSIRTs, did not advise EU-CyCLONe, the bridge between technical responders and political crisis coordination. This is not the same as saying that national authorities did nothing. Airport operators and national services took operational steps. The documented gap concerns the formal cross-border reporting and escalation route.

That distinction is central to accountability. A headline saying that Brussels failed to stop the ransomware would assign the wrong responsibility. An attacker compromised a commercial provider, and prevention and recovery were not controlled by the Commission. But a system designed to share warning signals across borders ought to be judged by whether information from an incident involving several countries travels through the agreed channels. The audit's evidence says that, in this case, it did not.

## The documentary timeline: laws, money and unfinished mechanisms

The first Network and Information Security Directive, adopted in 2016, established a network of national response teams. In 2020 EU-CyCLONe began as an informal forum for national cyber-crisis officials. The revised NIS2 directive, adopted in 2022 and entering into force in 2023, gave EU-CyCLONe a formal role and widened the scope of reporting duties. The 2021 Digital Europe Programme had meanwhile opened a dedicated funding route for cyber capacity. These are separate legal and budgetary acts, not a single order from one politician.

Member states were required to transpose NIS2 by 17 October 2024. The audit found only two did so by the deadline. On 28 November 2024, the Commission sent formal notices to lagging governments; on 7 May 2025, reasoned opinions followed. It requested financial penalties, but a referral and request for sanctions are not a court judgment or a penalty already imposed. A later status check of the four national proceedings is still required before publication.

The Cyber Solidarity Act entered into force on 4 February 2025, creating the legal framework for an EU Cybersecurity Reserve and a European Cybersecurity Alert System made of national and cross-border cyber hubs. The [Commission's policy description](https://digital-strategy.ec.europa.eu/en/policies/cyber-solidarity) explains that the reserve can deploy trusted private incident-response providers and that the hubs are intended to exchange threat warnings. The 2025 airport attack then tested the older reporting networks while the newer hubs were being built. On 21 September 2026, the ECA published its audit of implementation mainly during 2022-2025. The findings therefore describe the audited state, not a verified inventory of every repair made since.

## The decision and veto map: five different kinds of authority

The [European Parliament](/organizations/european-parliament) and Council are co-legislators: they can adopt or amend EU directives and regulations. The Commission proposes laws, monitors transposition, can launch infringement proceedings, and through its directorates manages or oversees elements of the funding and cyber situation architecture. Its political portfolio is associated with Executive Vice-President [Henna Virkkunen](/people/henna-virkkunen), whose [official Commission profile](https://digital-strategy.ec.europa.eu/en/miscellaneous/henna-virkkunen) includes technology sovereignty and security. This establishes political responsibility for the portfolio, not proof that she personally ordered a particular contract, rejected an incident report or controlled a national classification decision.

National governments hold the most consequential operational gate. Under the treaties, national security remains a member-state responsibility. National authorities classify incidents, decide what can be shared and apply domestic reporting laws. The ECA found that national-security restrictions, uncertainty over what qualifies as cross-border and lack of trust inhibit timely exchange. A Brussels official cannot simply override every national classification. Conversely, governments cannot plausibly treat a shared market's digital dependencies as entirely domestic when an attack propagates through a multinational service provider.

ENISA supplies expertise and secretariat support to the CSIRTs network and EU-CyCLONe. It is not a European cyber police force with universal power to demand raw incident records. The ECA noted positive feedback about ENISA's secretariat work from surveyed authorities. EU-CyCLONe connects the operational layer to political crisis management, but it depends on a signal from the technical network. The auditors found that the two networks still lacked formal procedural arrangements, common severity definitions and agreed criteria for escalation.

Finally, the European Cybersecurity Competence Centre (ECCC) in Bucharest manages relevant Digital Europe funding and coordinates national centres. Its executive director, Luca Tagliaretti, is identified in an [official Commission biography](https://commission.europa.eu/luca-tagliaretti_en); the ECCC's [governing-board announcement](https://cybersecurity-centre.europa.eu/news/luca-tagliaretti-elected-new-executive-director-eu-cybersecurity-competence-centre-2023-10-13_en) documents his appointment. That identifies an accountable administrative office, not individual culpability for findings spanning earlier programme years. The ECCC and its beneficiaries have separate duties to select, monitor and verify projects.

## The numbers: what €1.4 billion does and does not buy

The ECA says the Digital Europe Programme's overall 2021-2027 budget is €8.1 billion, with €1.4 billion allocated to strengthening cybersecurity. Allocation is not equivalent to disbursement, contractual expenditure, completed projects or a quantified reduction in cyber losses. It would be false to call all €1.4 billion a failed investment because one cross-border incident did not trigger formal escalation. It would be equally misleading to cite the allocation as proof that Europe's cyber response became more effective.

The auditors provide a more useful money trail. Twelve calls for cybersecurity proposals launched between November 2021 and December 2025 had €825 million in available EU funding, with another €212 million in grants planned for 2026 and 2027. These amounts are components of programme implementation and should not be added to the €1.4 billion as if they were separate budgets. For national coordination centres, the ECA recorded over €90 million granted, including about €44 million intended for onward financial support to third parties, and a further €38 million budgeted through 2027. These figures describe stages and instruments, not a single cash-flow accounting record.

A separate contract matters because it shows how an EU institution can buy information that resembles what it already receives. The Commission's DG Connect cyber situation centre relied substantially on external service providers contracted in December 2022 for nearly €18 million over four years. They supplied commercial threat-intelligence feeds, a dashboard and daily or weekly reporting. The ECA found parts of those outputs duplicated ENISA's permanent threat-monitoring capacity and information already used elsewhere in the Commission. It also warned that, with the contract due to expire in December 2026, there was no comprehensive plan at the audit date for continuing the centre's work. The report does not identify a proven unlawful award, a named private contractor's profit margin or a quantified amount wasted. A complete contract and payment accounting record would be needed to establish those claims.

## A warning network that had not started working

The European Cybersecurity Alert System was supposed to add a faster route for national and cross-border cyber hubs to detect and share threats. The ECA found that 13 member states had joined two early cross-border hubs, ATHENA and ENSOC, while a third hub, NBCC, had been allocated establishment funding for 2026, potentially taking participation to 20 countries including Iceland and Norway. But at the audit cut-off the first two hubs were not operational, primarily because of procurement delays. Cooperation agreements, common taxonomies and interoperability standards were also incomplete.

This creates a concrete chain of failure: public funds and political announcements can support building a hub, but a hub without tools, interfaces or trusted information-sharing rules cannot be counted as an operational warning service. The correct audit question is not merely whether the grant was signed. It is when the hub became capable of receiving and correlating threat indicators, whether its partners actually used it and whether it produced an actionable warning before or during a cross-border incident. The 2026 audit did not establish such outcomes for the two initial hubs.

The ECA's recommendation was to integrate the hubs with the CSIRTs network and EU-CyCLONe by 2028. That deadline should not be described as a legally binding promise already fulfilled. It is a proposed corrective horizon. The most useful next evidence would be dated acceptance tests, procurement milestones and independently verifiable incident exercises for ATHENA, ENSOC and NBCC.

## The financial beneficiaries: who can be named, and who cannot

The demonstrable institutional recipients include national coordination centres and selected Digital Europe project beneficiaries. The Commission's contracted cyber situation centre service providers had a documented nearly €18 million contract ceiling or value, but the public audit excerpt does not name those companies or establish their final payments. The Cybersecurity Reserve design likewise uses pre-contracted private responders. Those providers can obtain lawful commercial opportunities from a programme designed to protect public systems. A contractual opportunity is not proof of improper enrichment.

The ECA identified a narrower but serious control risk. Under Digital Europe, some cybersecurity funding can be limited to entities established and controlled in member states. For direct awards, the European Research Executive Agency's Central Validation Service can assess ownership and control. For onward grants to third parties, however, project beneficiaries perform their own checks. The ECCC did not validate their methodologies or sample-check whether ultimate recipients satisfied EU ownership and control rules. The auditors warned that weak verification could expose sensitive infrastructure, operational data and security-critical technologies. They did not establish that a particular ineligible foreign-controlled company had received a specified payment.

The financial incidence therefore has three distinct layers. Grant recipients receive a funding opportunity and contractual obligations. Taxpayers underwrite the public portion of the programme. Businesses, hospitals, transport users and public administrations bear costs if cyber incidents are not detected or coordinated effectively. But no audited counterfactual converts the programme's €1.4 billion allocation into a precise loss per taxpayer or a quantified gain for a named vendor. Any such number would require project-by-project award data, ownership checks, expenditure and service outcomes.

## Another gap: performance reports that cannot measure performance

The ECA examined a sample of 11 cybersecurity projects and found that almost none followed instructions for setting milestones and deliverables. Some projects had as many as 39 milestones or 45 deliverables, although guidance called for a much more focused structure. Meetings and administrative outputs sometimes counted as milestones even when they did not demonstrate better detection or response. Indicators lacked meaningful baselines, targets or measurability, and the auditors found no evidence that the ECCC verified the accuracy of aggregate programme performance data.

This is more than a paperwork complaint. A government can truthfully report that it financed an analysis centre, trained staff or held a meeting while still lacking evidence that an attack was detected earlier, a response was faster or a cross-border warning was transmitted. If the political promise is resilience, the output measure must be connected to resilience. The auditors called for a stronger traceable monitoring system and better grant-stage definitions by 2027.

The distinction between a project that is delayed, one that is useless and one that is fraudulent matters. The audit said all sampled projects pursued relevant objectives, while several suffered implementation problems. It did not find that every grant was illegitimate. A fair investigation should ask which deliverables are still pending, which systems have subsequently entered service, whether ECCC accepted the recommendations and how it will verify recipients' control. Those answers cannot be manufactured from an audit summary.

## The strongest counter-case: national sovereignty and real capacity building

The strongest defence of Europe's approach is not that every system worked. It is that cross-border cyber cooperation must coexist with national security, data protection, operational secrecy and differences in critical infrastructure. Some information about an active intrusion could itself endanger systems if circulated indiscriminately. The ECA explicitly recognised that national authorities must operate within their legal restrictions and recommended a legal and technical analysis rather than indiscriminate disclosure. It also recorded appreciation of ENISA's coordination work and recognised the value of pre-contracted emergency responders.

Preparedness is another legitimate output. An incident-response retainer can be unused precisely because no qualifying emergency occurred, or because domestic capacity handled the incident. The ECA's historical figures show 84% of 2023 Cybersecurity Support Action expenditure went to preparedness, and only four of 16 states with retainers used incident-response services. This is a warning about a possible mismatch with the future Reserve's response purpose, not proof that preparedness work was wasted. A service that helps a hospital resist an attack may never generate a dramatic activation statistic.

The Commission also has a real enforcement route. Its July 2026 referrals against four governments show that Brussels did not simply accept delayed NIS2 transposition. But infringement proceedings are slow, and they do not substitute for functioning incident-reporting networks in the meantime. The most charitable interpretation is that the EU is constructing a complex system under genuine constitutional constraints. The most demanding interpretation is that political leaders must now publish operational tests rather than rely on budget allocations and legal architecture as evidence of success.

## What the incident data can prove

The audit recorded 14 significant cross-border incidents reported by seven member states in 2025, compared with two such reports in 2024, none in 2023 and three in 2022. Separately, ENISA's 2024 threat-landscape analysis identified 322 incidents targeting two or more member states. These are not the same population, reporting period or threshold. The difference signals potential underreporting but is not a valid percentage of missed legally reportable incidents.

The [ENISA Threat Landscape 2025](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025) examined 4,875 incidents from July 2024 through June 2025, using a broader threat-intelligence method. The [2026 ENISA edition](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2026) covers January through December 2025 and describes the expanding risks of digital dependencies. Neither series should be subtracted mechanically from national NIS2 notifications. The useful indicators are instead the share of qualifying cross-border incidents reported on time, median time to notify affected states, time from detection to coordinated response, availability of hub services and independent verification of grant results. The direction sought is more timely and complete reporting, shorter response times and fewer unverified outputs. No baseline is invented here.

## Accountability test: five records that could change the verdict

First, national authorities should publish anonymised explanations of how the Collins Aerospace episode was classified, why no formal cross-border notice went to ENISA and whether a later review changed that interpretation. Second, the CSIRTs network and EU-CyCLONe should show agreed escalation criteria and the date they were adopted. Third, the Commission should disclose how it intends to avoid duplicating ENISA's threat intelligence after the December 2026 situation-centre contract expiry. Fourth, the ECCC should provide its sample-based ownership checks for onward-funded beneficiaries and evidence that its performance indicators were independently verified. Fifth, the responsible bodies should document when ATHENA and ENSOC actually became operational and whether an exercise demonstrated a useful cross-border alert.

The [ECA's five recommendations](https://www.eca.europa.eu/ECAPublications/SR-2026-19/SR-2026-19_EN.pdf) provide a timetable extending through 2028. The political accountability of the Commission, including the portfolio held by Virkkunen, and the administrative accountability of the ECCC and national authorities can be assessed against those dates. That is a narrower and more defensible proposition than accusing a named politician of causing the ransomware attack or a vendor of stealing cyber funds.

## Conclusion: a system cannot claim the value of information it never shared

Europe has built a legal framework, agencies, funding programmes and contractor relationships for cyber defence. The audit shows an unresolved gap between that architecture and the exchange of actionable information. In the airport incident, the absence of formal escalation is documented. In the funding programme, delayed hubs and weak verification are documented. The financial and operational consequences are important but not fully quantified. The evidence supports a verdict of partial effectiveness and unproven performance, not a verdict of criminal diversion.

A serious follow-up should measure what changed after September 2026: which governments completed NIS2 transposition, which hub systems passed tests, how much money was actually paid, which recipients passed ownership screening and whether the next cross-border attack generated the alerts this one did not. That is how a €1.4 billion allocation becomes an accountable public investment rather than a political talking point.

## Documentary sources and reporting

1. [European Court of Auditors, Special Report 19/2026, full report, 21 September 2026](https://www.eca.europa.eu/ECAPublications/SR-2026-19/SR-2026-19_EN.pdf) - main findings, audit scope, figures, recommendations and limits.
3. [European Commission, EU Cyber Solidarity Act policy explainer](https://digital-strategy.ec.europa.eu/en/policies/cyber-solidarity) - hubs, Reserve and programme financing.
4. [ENISA, Threat Landscape 2025, 1 October 2025](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025) - independent agency threat dataset and methodology.
5. [ENISA, Threat Landscape 2026, 22 September 2026](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2026) - more recent threat assessment, different observation window.
6. [Reuters, Poor data sharing undermining EU cyber defences, 21 September 2026](https://www.reuters.com/legal/government/poor-data-sharing-undermining-eu-cyber-defences-auditors-say-2026-09-21/) - independent coverage of auditors' conclusions.
7. [Reuters, European airports work to bring check-in back to normal, 22 September 2025](https://www.reuters.com/business/aerospace-defense/eu-agency-says-third-party-ransomware-behind-airport-disruptions-2025-09-22/) - contemporary incident and operational response.
8. [Associated Press, Airport cyberattack disrupts more flights, 21 September 2025](https://apnews.com/article/4eb95c1157cf34b606e021088256d20a) - independent incident reporting and limitations.
9. [European Commission, Henna Virkkunen official portfolio](https://digital-strategy.ec.europa.eu/en/miscellaneous/henna-virkkunen) - political portfolio, not proof of personal involvement in individual decisions.
10. [European Commission, Luca Tagliaretti biography](https://commission.europa.eu/luca-tagliaretti_en) - ECCC executive identity.
11. [ECCC, executive director election announcement, 13 October 2023](https://cybersecurity-centre.europa.eu/news/luca-tagliaretti-elected-new-executive-director-eu-cybersecurity-competence-centre-2023-10-13_en) - appointment and agency mandate.
12. [Directive (EU) 2022/2555, official EU legal text](https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng) - statutory reporting framework; direct browser access may require JavaScript.

Editorial disclosure: The Commission, ECCC and ENISA responses are linked from the ECA report's publication page, but their complete separate response documents were not independently retrieved in this research pass. The audit's observations and official policy descriptions are not a substitute for an obtained right of reply. No direct contact with any named person or institution is claimed. Internal context links and a licensed subject photograph have been supplied for this manuscript. Independent editorial and legal QA are mandatory before import or publication.

## Methodology

https://factrail.ai/methodology

Canonical: https://factrail.ai/articles/eu-cyber-cross-border-alerts-audit-funding-2026