Critical infrastructure risk is usually argued from vendor surveys, while the most authoritative numbers sit in government incident reports that few practitioners read side by side. National cyber agencies in the UK, Australia, Canada and the EU, the FBI's Internet Crime Complaint Center (IC3) and the US Government Accountability Office (GAO) each publish figures on attacks against essential services, but they count different things over different periods. This page brings those government and regulator figures together across sectors, with the publisher, report and period in the same sentence or table row, and explains how far each can be compared. It is for CISOs, risk and resilience leads, regulators' liaison teams and policy staff in energy, transport, water, health, telecoms and government who need defensible numbers. Industrial control system and OT vendor research is covered separately in the OT and ICS Security Statistics Guide.
Last reviewed: November 2026.
Source note: every figure is quoted from the government or regulator publication named beside it, as checked in November 2026; interpretation and recommendations are NHI Mgmt Group's own and labelled as such. Confirm against the official text before relying on it.
Key takeaways
- Serious incidents are rising in government counts. The UK NCSC handled 204 nationally significant incidents in the 12 months to August 2025, up from 89 the year before, out of 429 incidents in total.
- Critical infrastructure is a growing share of national caseloads. The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 puts critical infrastructure at 13% of the incidents it responded to, up 2 percentage points.
- Volume is dominated by disruption, not intrusion. ENISA's Threat Landscape 2025 (v1.3) attributes almost 80% of 4,875 EU incidents to hacktivism and about 76.7% to DDoS, with public administration the most targeted sector at 38.2%.
- Ransomware is the main criminal threat to essential services. Canada's National Cyber Threat Assessment 2025-2026 calls ransomware the top cybercrime threat to Canadian critical infrastructure, and the FBI IC3 2025 report names critical manufacturing, healthcare and government facilities as the sectors most hit by the top ransomware variants.
- Oversight lags the threat. GAO-24-106221 found none of the four lead federal agencies for high-ransomware sectors had determined how far their sectors had adopted NIST's ransomware practices, and 10 of its 11 recommendations were still open in January 2026.
Headline statistics
| Statistic | Figure | Source, publisher and period |
|---|---|---|
| Nationally significant incidents handled (UK) | 204 (89 in the previous year) | NCSC Annual Review 2025, 12 months to August 2025 |
| Highly significant incidents (UK) | 18, an almost 50% increase | NCSC Annual Review 2025 |
| Total incidents handled (UK) | 429 | NCSC Annual Review 2025 |
| Critical infrastructure share of incidents (Australia) | 13%, up 2 percentage points | ASD Annual Cyber Threat Report 2024-25 (financial year to 30 June 2025) |
| Proactive notifications to critical infrastructure entities (Australia) | Over 190, up 111% | ASD Annual Cyber Threat Report 2024-25 |
| EU incidents analysed | 4,875 | ENISA Threat Landscape 2025 v1.3, 1 July 2024 to 30 June 2025 |
| Public administration share of EU incidents | 38.2% | ENISA Threat Landscape 2025 v1.3 |
| Ransomware complaints to IC3 (all sectors) | 3,611 | FBI IC3 Internet Crime Report 2025, calendar year 2025 |
| Critical infrastructure ransomware victims (US) | 870 organisations in 14 of 16 sectors | FBI figure for 2022, reported in GAO-24-106221 (January 2024) |
| Growth in ransomware incidents known to Canada's Cyber Centre | Average 26% per year since 2021 | Canadian Centre for Cyber Security, National Cyber Threat Assessment 2025-2026 |
National incident reports compared
Each agency publishes on its own cycle and defines incidents its own way. Read the figures as trends inside each series, not as one global number.
| Publisher and report | Period | What it counts | Critical infrastructure figures |
|---|---|---|---|
| UK NCSC, Annual Review 2025 | 1 September 2024 to 31 August 2025 | Incidents handled by the NCSC incident management team, categorised by severity | Nationally significant incidents are defined as having a substantial impact on national security, the economy or critical infrastructure; highly significant incidents have the potential for serious impact on essential services |
| Australian Signals Directorate, Annual Cyber Threat Report 2024-25 | Financial year 2024-25 | Incidents ASD's ACSC responded to (over 1,200; 1,253 in its severity breakdown) | CI is 13% of incidents; separate breakdown of incident and activity types for CI |
| ENISA, Threat Landscape 2025 (v1.3, corrected figures, September 2026) | 1 July 2024 to 30 June 2025 | 4,875 publicly reported and observed incidents affecting the EU | Sector shares among incidents with an identified sector (28.5% had none) |
| FBI IC3, Internet Crime Report 2025 | Calendar year 2025 | 1,008,597 complaints, $20.877 billion reported losses | Critical infrastructure ransomware section; sectors most affected by the top 10 variants |
| Canadian Centre for Cyber Security, NCTA 2025-2026 | Assessment published for 2025-2026 | Analytic judgements with estimative language | Ransomware and state threats to Canadian CI, sector growth figures |
- UK: the NCSC's jump from 89 to 204 nationally significant incidents is the sharpest movement in any government series on this page. The NCSC defines these by impact on national security, the economy or critical infrastructure, so the count is a direct measure of serious national impact rather than raw volume.
- Australia: for critical infrastructure, ASD reports the top incident types as compromised asset, network or infrastructure (55%), denial of service (23%) and compromised account or credentials (19%), and the top activity types as scanning or reconnaissance (41%), denial of service (31%) and phishing (20%). The obligations behind these reports are in the Australia SOCI Act Guide.
- Canada: the Cyber Centre judges that state-sponsored actors are "very likely" (75 to 89% in its estimative scale) targeting critical infrastructure networks in Canada and allied countries to prepare for possible disruptive operations, and that pro-Russia non-state actors will likely try to disrupt vulnerable internet-connected OT in Canadian critical infrastructure.
Sector targeting
ENISA gives the most granular cross-sector split. The shares below are of EU incidents with an identified sector, from the corrected v1.3 edition; earlier editions of the same report carried different figures, so cite v1.3.
| Sector (EU) | Share of incidents | Notes from the same report |
|---|---|---|
| Public administration | 38.2% | ENISA describes public administrations as increasingly targeted by hacktivists, mainly with DDoS |
| Transport | 7.5% | Second most targeted sector |
| Digital infrastructure and services | 4.8% | Includes providers other sectors depend on |
| Finance | 4.5% | The report's finance section gives 4.7%; the sector ranking gives 4.5% |
| Manufacturing | 2.9% | See the OT and ICS statistics for manufacturing ransomware data |
| Health | 4.2% of cybercrime incidents | A share of cybercrime only, not of all incidents |
- US ransomware by sector: the FBI IC3 2025 report names critical manufacturing, healthcare and public health, and government facilities as the critical infrastructure sectors most affected by the top 10 ransomware variants. GAO-24-106221 reported that nearly half of 870 critical infrastructure ransomware victims in 2022 came from four sectors: critical manufacturing, energy, healthcare and public health, and transportation systems.
- Canada by sector: the NCTA 2025-2026 reports that observed Canadian ransomware incidents rose 75% in healthcare and 67% in energy from 2022 to 2023.
- What this means (our reading): sectors with public-facing services (government, transport) dominate hacktivist volume, while sectors with operational downtime costs (manufacturing, health, energy) dominate ransomware impact. Plan controls for both patterns. The Critical Infrastructure Identity Security Guide covers the access controls that matter most for the second.
How attackers get in and what they do
| Measure | Figure | Source |
|---|---|---|
| Phishing (including vishing, malspam, malvertising) as intrusion vector | About 60% of observed cases | ENISA Threat Landscape 2025 v1.3 |
| Vulnerability exploitation as intrusion vector | 21.3% | ENISA Threat Landscape 2025 v1.3 |
| Botnets as intrusion vector | 9.9% | ENISA Threat Landscape 2025 v1.3 |
| Compromised account or credentials, CI incidents (Australia) | 19% | ASD Annual Cyber Threat Report 2024-25 |
| Ransomware variants deployed against EU organisations | 82 (Akira 11.6%, SafePay 10.1%, Qilin 7.5%) | ENISA Threat Landscape 2025 v1.3 |
| Ransomware share of cybercrime activity on monitored leak sites and forums | 81% | ENISA Threat Landscape 2025 v1.3 |
- Disruption is common but often shallow (our reading): DDoS and hacktivism dominate counts, yet the deeper incidents (compromised networks and credentials) drive the national significance categories. Do not let volume charts steer budget away from identity and access.
- Credentials remain a reliable route: one in five Australian CI incidents involved compromised accounts or credentials. Machine credentials such as remote access service accounts and vendor accounts are part of that picture. See the OT and Critical Infrastructure Executive Briefing.
- Pre-positioning is a state priority: Canada's assessment cites Volt Typhoon's pre-positioning in US infrastructure as a risk that could affect Canada through interconnected North American systems.
Regulatory and audit findings
Audit bodies and regulators publish a different kind of statistic: how well oversight is working. These are fewer, but they carry weight with boards and policy makers.
- GAO-24-106221 (30 January 2024): found none of the lead federal agencies for critical manufacturing, energy, healthcare and transportation had determined how far their sectors had adopted NIST's recommended ransomware practices, and none had fully assessed the effectiveness of their support. GAO made 11 recommendations to the Departments of Energy, Health and Human Services, Homeland Security and Transportation; the GAO page showed 10 of 11 still open as of January 2026.
- Losses context: the same GAO report cites Treasury figures of $886 million in US ransomware-related losses in 2021, a 68% increase on 2020, and notes that the full impact is likely unknown because reporting is generally voluntary.
- CIRCIA reporting: CISA's page on the Cyber Incident Reporting for Critical Infrastructure Act states that covered incidents must be reported within 72 hours and ransom payments within 24 hours once the final rule takes effect, and describes that effective date as yet to be determined. Until then, US cross-sector counts remain voluntary. See the CIRCIA Incident Reporting Guide.
- Mandatory regimes produce better data: the EU NIS2 and Australian SOCI regimes create mandatory reporting, which is one reason ENISA and ASD can publish sector splits. The regimes are compared in the Critical Infrastructure Regulation Map.
Comparing and using these figures
| Question | Best source on this page | Caution |
|---|---|---|
| Are serious national incidents increasing? | NCSC nationally significant counts | Definitions are NCSC's own; compare year on year within the series |
| Which sectors are targeted in the EU? | ENISA sector shares | Use v1.3 corrected figures; 28.5% of incidents had no sector |
| What share of national incidents hit CI? | ASD's 13% | Australian definitions and only incidents ASD responded to |
| Which US CI sectors suffer ransomware? | IC3 2025 and GAO-24-106221 | Complaint-based and voluntary, so undercounted |
| Is oversight effective? | GAO recommendation status | Status changes; check the GAO page |
- Pick the series closest to your jurisdiction and sector: a UK water utility should lead with NCSC and its sector regulator, not ENISA percentages.
- Quote the period and edition: ENISA corrected its 2025 figures in v1.3; ASD reports by financial year; IC3 by calendar year.
- Do not add series together: the same incident can appear in several reports, and definitions differ.
- Pair a threat figure with a control: for example, the ASD credentials figure supports a case for MFA and privileged access on remote access paths, which the Critical Infrastructure Identity Security Guide sets out.
- Refresh annually: all of these sources are recurring. Diary their usual publication months and update board material when they change.
Measuring your own position
National statistics show the threat; your own metrics show exposure. These are measures that map to the figures above.
| Metric | Links to | Target direction |
|---|---|---|
| Remote access and vendor accounts protected by phishing-resistant MFA | Phishing and credential vectors (ENISA, ASD) | 100% |
| Internet-facing services with tested DDoS protection | DDoS share (ENISA, ASD) | All essential services |
| Days to patch known exploited vulnerabilities on internet-facing systems | Vulnerability exploitation at 21.3% (ENISA) | Falling, within regulator or internal target |
| Ransomware recovery tests completed for essential services | Ransomware as top cybercrime threat (Canada, IC3) | At least annually per service |
| Incidents reported within the regulator's deadline | Mandatory reporting regimes (NIS2, SOCI, CIRCIA when effective) | 100% |
Framework mapping
| Statistic theme | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Phishing and credential compromise | PR.AA-03 authentication | IA-2 Identification and Authentication (Organizational Users) |
| Vulnerability exploitation | ID.RA-01 vulnerabilities identified | RA-5 Vulnerability Monitoring and Scanning, SI-2 Flaw Remediation |
| DDoS | PR.IR-04 capacity | SC-5 Denial-of-service Protection |
| Ransomware recovery | RC.RP-01 recovery plan executed | CP-9 System Backup, CP-10 System Recovery and Reconstitution |
| Incident reporting | RS.CO-02 stakeholders notified | IR-6 Incident Reporting |
Common failure patterns
- Quoting superseded figures: ENISA corrected its 2025 Threat Landscape figures in v1.3; slides built from the earlier edition carry numbers the publisher no longer stands behind.
- Treating volume as risk: hacktivist DDoS dominates EU counts, but ENISA's intrusion vector data and ASD's compromised network figures point to where lasting damage comes from.
- Reading complaint data as prevalence: IC3 and GAO both rely on voluntary reporting, and GAO states the full impact is likely unknown.
- Mixing jurisdictions: citing ASD's 13% as if it applied to the UK or EU, where definitions and reporting rules differ.
- Using numbers without a decision: a statistic in a board paper with no linked control, owner or metric changes nothing.
Practitioner checklist
- Use government and regulator figures first; attribute vendor research to the vendor.
- Quote publisher, report, edition and period with every figure.
- Cite ENISA Threat Landscape 2025 figures from the corrected v1.3 edition.
- Never combine figures from different national series into one total.
- Link each threat statistic in board papers to a control and a metric you own.
- Track CIRCIA final rule status and your NIS2 or SOCI reporting duties.
- Diary annual publication of NCSC, ASD, ENISA, IC3 and Cyber Centre reports and refresh this evidence.
- Report the five exposure metrics above to the resilience committee quarterly.
Standards and references
- NCSC: UK experiencing four nationally significant cyber attacks every week (Annual Review 2025)
- Australian Signals Directorate: Annual Cyber Threat Report 2024-2025
- ENISA: Threat Landscape 2025
- FBI IC3: Internet Crime Report 2025
- Canadian Centre for Cyber Security: National Cyber Threat Assessment 2025-2026
- GAO: Critical Infrastructure Protection, Agencies Need to Enhance Oversight of Ransomware Practices (GAO-24-106221)
- CISA: Cyber Incident Reporting for Critical Infrastructure Act of 2022
Related NHI Mgmt Group resources: OT and ICS Security Statistics Guide · Critical Infrastructure Identity Security Guide · Critical Infrastructure Regulation Map · Ransomware Statistics Guide · FBI IC3 Internet Crime Report