Transport and Aviation Cyber Statistics (2026)

Transport is now the second most targeted sector in the EU, yet the numbers quoted in transport and aviation board papers are often recycled press figures with no period, no publisher and no definition of what was counted. This page collects the primary figures that hold up: the ENISA Threat Landscape 2025 and ENISA's transport threat landscape, EUROCONTROL's European Air Traffic Management Computer Emergency Response Team (EATM-CERT) analyses of aviation, and the Australian Signals Directorate (ASD) Annual Cyber Threat Report 2024-25. Each figure carries its publisher, edition and period, and a short note on what it can and cannot support. It is for CISOs, OT security leads, risk owners and auditors at airlines, airports, air navigation service providers, rail and road operators, ports and logistics firms who need defensible numbers for risk registers, NIS2 business cases and supplier reviews. Last reviewed: November 2026.

Key takeaways

Transport is the EU's second most targeted sector. 7.5% of the 4,875 incidents ENISA analysed between July 2024 and June 2025 hit transport, behind only public administration at 38.2% (ENISA Threat Landscape 2025).
Ransomware share roughly doubled in two years. ENISA's transport analysis found ransomware rose from 13% of transport incidents in 2021 to 25% in 2022, with cybercriminals behind 55% of incidents and hacktivists 23%.
Aviation ransomware mostly lands on suppliers. EUROCONTROL counted about 2.5 reported ransomware attacks a week on aviation-related organisations worldwide across 2021 and 2022, with the majority hitting manufacturers and the wider supply chain rather than airlines or airports.
One shared supplier can stop several airports. The September 2025 ransomware incident at Collins Aerospace's MUSE passenger processing system disrupted check-in at Brussels, Berlin, Heathrow and Dublin, which ENISA described as a third-party ransomware incident.
Transport weighs heavily in critical infrastructure reporting. In Australia, transport, postal and warehousing made up 5% of all incidents ASD responded to in FY2024-25 but 26% of critical infrastructure incidents, second only to finance.

How to read transport and aviation cyber statistics

Transport figures come from three kinds of source, and they measure different things. Mixing them without saying so is the most common error in transport security papers.

Source type	Examples	What it counts	Main limitation
Agency threat landscapes	ENISA Threat Landscape, ENISA transport threat landscape	Publicly reported and open source incidents, classified by sector, threat and actor	Skewed to what becomes public; DDoS and hacktivist claims are over-represented
Sector CERT data	EUROCONTROL EATM-CERT data snapshots and think papers	Incidents reported or detected across aviation stakeholders, including fraud and fake websites	Broad definition of "attack" (fraudulent websites count); editions use different scopes
National incident response data	ASD Annual Cyber Threat Report	Incidents reported to and handled by a national agency	One country; sector coding (ANZSIC divisions) does not match EU NIS2 sectors

Sector boundaries differ: ENISA's transport sector follows NIS2 (air, rail, water and road transport). ASD reports the ANZSIC division "transport, postal and warehousing", which adds postal and storage. EUROCONTROL counts aviation stakeholders, including manufacturers and civil aviation authorities.
Counts are not impact: a sector share tells you where incidents were recorded, not how much disruption they caused. ENISA notes that hacktivist incidents, almost 80% of its 2025 data set, caused service disruption in only 2% of cases.
Periods do not line up: ENISA's 2025 report runs July to June, ENISA's transport report ran January 2021 to October 2022, ASD uses the Australian financial year and EUROCONTROL uses calendar years. Quote the period with every figure.

For the cross-sector context, see the Cybersecurity Statistics Guide. Public administration, the only sector ahead of transport in the ENISA data, is covered in the Public Sector Cyber Statistics Guide.

European Union: transport across all modes

ENISA publishes the main EU-wide figures. Two releases matter for transport: the annual Threat Landscape, which ranks sectors, and the dedicated transport threat landscape published on 21 March 2023.

Figure	Value	Source and period
Transport share of EU incidents	7.5% (second of all sectors)	ENISA Threat Landscape 2025, 1 July 2024 to 30 June 2025, 4,875 incidents
Sector ranking around transport	Public administration 38.2%, transport 7.5%, digital infrastructure and services 4.8%, finance 4.5%, manufacturing 2.9%	ENISA Threat Landscape 2025
DDoS share of all incidents	77%	ENISA Threat Landscape 2025, all sectors
Phishing as intrusion vector	About 60%; vulnerability exploitation 21.3%	ENISA Threat Landscape 2025, all sectors
Incidents at NIS2 essential entities	53.7%	ENISA Threat Landscape 2025, all sectors
Ransomware share of transport incidents	13% in 2021, 25% in 2022	ENISA transport threat landscape, January 2021 to October 2022
Actors behind transport incidents	Cybercriminals 55%, hacktivists 23%; state-sponsored actors also reported	ENISA transport threat landscape, January 2021 to October 2022

What this supports: that transport is a priority target in the EU, that its incident mix is dominated by availability attacks and criminal ransomware, and that every mode (aviation, maritime, rail and road) appears in the data. What it does not support: a per-mode ranking. The ENISA press material does not publish subsector shares, so avoid claims such as "aviation is the most attacked mode" unless you can cite the full report's tables.

The all-sector percentages (DDoS, phishing, essential entities) describe the whole ENISA data set, not transport alone. Use them as context, labelled as such. The ransomware rise from 13% to 25% is the strongest transport-specific trend figure ENISA has published, but it is now several years old; pair it with newer supplier incidents when you present it.

Aviation: EUROCONTROL EATM-CERT figures

EUROCONTROL's EATM-CERT collects incident data from European aviation stakeholders and adds worldwide events shared with it. Its published analyses are the best primary source on aviation, with two caveats: they include fraud and fake websites as "attacks", and the most detailed breakdown is for 2020.

Figure	Value	Source and period
Ransomware tempo against aviation	About 2.5 reported attacks per week worldwide	EUROCONTROL Data Snapshot #39 (7 February 2023), 2021 to 2022
Where aviation ransomware lands	Majority of incidents at original equipment manufacturers and the supply chain	EUROCONTROL Data Snapshot #39
Typical ransom demand	Around 5% of annual revenue ("big game hunting")	EUROCONTROL Data Snapshot #39
Growth in reported attacks	530% increase from 2019 to 2020	EUROCONTROL Think Paper #12 (5 July 2021)
Airlines	775 attacks, 61% of the total; 95% financially motivated	EUROCONTROL Think Paper #12, 2020
Manufacturers	206 attacks, 16%; 39 ransomware attacks	EUROCONTROL Think Paper #12, 2020
Airports	178 attacks, 15%; 100 involved fraudulent websites	EUROCONTROL Think Paper #12, 2020
Air navigation service providers	72 attacks; 39 phishing or malware; 3 caused operational disruption	EUROCONTROL Think Paper #12, 2020
Attack types, all aviation	Data theft 36%, fraudulent websites 35%, phishing 16%, ransomware 5%, malware 5%	EUROCONTROL Think Paper #12, 2020
Fake airline websites	335 found	EUROCONTROL Think Paper #12, 2020
Compromised loyalty accounts on the dark web	15,493	EUROCONTROL Think Paper #12, 2020

Two patterns stand out. First, airlines absorb most of the volume, and almost all of it is fraud: fake refund and ticket sites, loyalty account theft and data theft. Second, the operationally dangerous end is small in count but concentrated: manufacturers carry most ransomware, and only three of 72 ANSP incidents in 2020 caused operational disruption. A risk register that weights incidents by count will overstate fraud and understate supplier ransomware.

The 2020 numbers are the most detailed public breakdown, not the most recent. Present them as a baseline, dated, and do not extrapolate a current annual total from them. EUROCONTROL opened consultation on a cyber maturity assessment scheme for the aviation supply chain in April 2026, which reflects the same supplier concentration. For the controls side, see the Aviation Cybersecurity Guide and the EASA Part-IS Information Security Guide.

Supply chain disruption: the shared platform problem

Transport runs on shared platforms: common-use passenger processing at airports, port community systems, rail traffic management suppliers and freight booking platforms. A single supplier incident therefore hits many operators at once, which no single operator's incident count shows.

Collins Aerospace MUSE, September 2025: a ransomware incident at the passenger processing system used by airlines to share check-in desks and boarding gates disrupted London Heathrow, Brussels, Berlin and Dublin from Friday 19 September. ENISA said the disruption was "caused by a third-party ransomware incident". Brussels Airport cancelled 25 of 234 flights on the Saturday, 50 of 257 departures on the Sunday and about 60 of 550 arrivals and departures on the Monday, as reported by Computing.
Manufacturer concentration: EUROCONTROL's finding that the majority of aviation ransomware hits manufacturers and suppliers means the likely route to an operational outage at an airline or airport is through a supplier, not through its own perimeter.
Manual fallback is the real control: airports affected by the MUSE incident reverted to manual check-in and boarding. The size of the cancellation numbers depended on how well that fallback had been rehearsed.

For incident counts, this means supplier incidents should be recorded once per affected operator in your own register (because each operator bore the impact) but once in total when comparing with sector statistics. See the Cloud Concentration Risk and Exit Strategy Guide for the concentration analysis method.

Australia: transport in critical infrastructure reporting

ASD's Annual Cyber Threat Report gives a clean national view, coded by ANZSIC division, which is useful for operators with Australian assets under the Security of Critical Infrastructure (SOCI) Act.

Figure	Value	Source and period
Incidents ASD responded to	More than 1,200, up 11% on the previous year	ASD Annual Cyber Threat Report 2024-25, FY2024-25
Critical infrastructure share of incidents	13%, up 2% on the previous year (as ASD states it)	ASD Annual Cyber Threat Report 2024-25
Transport, postal and warehousing share of all incidents	5%	ASD Annual Cyber Threat Report 2024-25
Transport, postal and warehousing share of CI incidents	26% (second after financial and insurance services at 32%)	ASD Annual Cyber Threat Report 2024-25
Notifications to CI entities of potential malicious activity	More than 190, up 111%	ASD Annual Cyber Threat Report 2024-25

The gap between 5% of all incidents and 26% of CI incidents is the useful point: transport is not the loudest sector overall, but within critical infrastructure it is one of the two most affected. The notification count measures ASD outreach, not incidents, so do not add it to the incident totals.

Where identity fits

The statistics above rarely break incidents down by identity, but the attack types they record are identity-heavy. Phishing is the leading intrusion vector in the ENISA data, airline fraud in the EUROCONTROL data is largely account takeover and loyalty account theft, and shared platforms such as passenger processing and port community systems rely on supplier remote access and service accounts that connect many operators.

Supplier and maintenance access: remote access accounts held by OEMs and integrators are the path a supplier compromise takes into an operator. Inventory them, require MFA and time-bound access, and log their sessions.
Machine credentials between operators: API keys and certificates linking airlines, airports, ground handlers and booking systems are long-lived and shared. Rotate them after any supplier incident.
Customer accounts: loyalty programmes are a fraud target in their own right; treat them as stored value.

See the Logistics and Transport Identity Security Guide for the identity controls in depth.

What the numbers mean for defenders

Statistic	Implication	Control response	ATT&CK reference
Transport 7.5% of EU incidents, DDoS 77% overall	Expect hacktivist availability attacks around political events	DDoS protection on public booking, timetable and passenger information sites; status page and comms plan	T1498 Network Denial of Service
Ransomware 13% to 25% of transport incidents	Criminal ransomware is the main operational threat	Offline backups, IT/OT segmentation, tested manual fallback	T1486 Data Encrypted for Impact
Majority of aviation ransomware at suppliers	Your outage is likely to start at a supplier	Supplier tiering, contractual notification, shared platform exit plans	T1195 Supply Chain Compromise
Phishing about 60% of intrusion vectors	Credential theft remains the main way in	Phishing-resistant MFA for staff, suppliers and administrators	T1566 Phishing
3 of 72 ANSP incidents disrupted operations (2020)	Operational impact is rare but severe	OT incident playbooks and safety case integration	T0828 Loss of Productivity and Revenue (ICS)

For deeper figures on each threat, see the Ransomware Statistics Guide, the DDoS Attack Statistics page and the OT and ICS Security Statistics Guide.

Using these figures in a business case

Start with the sector rank. Use the ENISA 2025 transport share (7.5%, second of all sectors) as the headline, with its period and data set size.
Add the trend. Use ENISA's ransomware rise from 13% to 25%, dated 2021 to 2022, and say that it is the latest transport-specific trend ENISA has published.
Make it about your mode. For aviation, add EUROCONTROL's supplier finding; for Australian assets, add the ASD 26% of CI incidents figure.
Show a real disruption. Use the Collins Aerospace MUSE incident to show how a supplier incident becomes cancelled flights, with the reported cancellation numbers.
Map to obligations. Transport entities are in scope for NIS2 and, for aviation, EASA Part-IS; incident reporting clocks apply. See the Cyber Incident Reporting Requirements Map.
Close with your own data. External statistics justify attention; your own incident and supplier data justify the budget line.

Metrics to track

Supplier coverage: percentage of tier 1 transport suppliers (passenger processing, traffic management, port community, booking) with a current security assessment and incident notification clause.
Manual fallback readiness: time to switch critical passenger or freight processes to manual operation in the last exercise, against target.
Phishing-resistant MFA coverage: percentage of staff, supplier remote access and administrator accounts on phishing-resistant MFA.
Recovery time for shared platforms: recovery time objective agreed with each shared platform supplier, and the measured time in the last test.
DDoS mitigation time: median time from detection to mitigation for public-facing services.
Reporting clock compliance: percentage of reportable incidents notified within the NIS2 or national deadline.

Common failure patterns when using transport statistics

Quoting an undated aviation total: figures such as a single "attacks per year" number circulate without period or definition. The EUROCONTROL breakdown is for 2020 and counts fraudulent websites as attacks; say so.
Treating hacktivist DDoS counts as impact: almost 80% of ENISA's 2025 incidents were hacktivist and only 2% of those caused disruption. Counts inflate perceived risk to public websites and hide quieter ransomware intrusions.
Applying all-sector figures to transport: the ENISA phishing and DDoS percentages describe all sectors. Label them as context.
Counting only your own perimeter: the MUSE incident and EUROCONTROL's supplier finding show that the outage usually starts elsewhere. A register that excludes supplier incidents understates risk.
Mixing sector definitions: ASD's "transport, postal and warehousing" is not ENISA's NIS2 transport sector. Do not add or compare them directly.

Framework mapping

Theme	NIST CSF 2.0	NIST SP 800-53 Rev. 5
Use threat statistics in risk assessment	ID.RA-03	RA-3
Assess and monitor supplier risk	GV.SC-07	SR-6
Security requirements in supplier contracts	GV.SC-05	SR-6
Manual fallback and continuity	RC.RP-01	CP-2
Notify stakeholders and regulators of incidents	RS.CO-02	IR-6

Practitioner checklist

Quote every transport figure with publisher, report name, period and data set size.
Label all-sector figures as context when used in a transport paper.
Present the EUROCONTROL 2020 breakdown as a dated baseline, not a current total.
List tier 1 shared platform suppliers and record their incidents in your risk register.
Rehearse manual fallback for passenger, freight and traffic management processes at least annually.
Put phishing-resistant MFA on supplier remote access and administrator accounts first.
Rotate shared API keys and certificates after any supplier incident.
Review this page's figures each time ENISA, EUROCONTROL or ASD publish a new edition.

Transport and Aviation Cyber Statistics: Sourced Figures on Incidents, Ransomware and Suppliers