Ransomware and data breaches were the most prominent cyber-threats affecting Europe’s transportation sector last year, with incidents of the former almost doubling in volume, according to ENISA.
The EU security agency’s first ever threat landscape report for the vertical covers the period January 2021 to October 2022.
It claimed that ransomware incident reports increased from 13% of the total in 2021 to 25% in 2022, while malware reports declined from 11% to 6% and data breaches and leaks slumped from 21% to 9%.
However, that still makes data-related threats the second most prolific category over the period after ransomware, with attackers targeting credentials, employee and customer personal information, and intellectual property.
Read more on transportation cyber-threats: US Shipping Giant Loses $7.5m in Ransomware Attack.
Over half (55%) of incidents tracked by ENISA over the period were traced to cyber-criminals, meaning they were likely to be financially motivated. Hacktivists accounted for another quarter (23%), which partly explains the six-fold surge in DDoS attacks, from 2% to 13% between 2021 and 2022.
European airports, railways and transport authorities were among the victims of those attacks, ENISA said.
State-backed attacks accounted for another 15% of the total and were largely aimed at the maritime sector and government transport authorities, according to the report.
“Transport is a key sector of our economy that we depend on in both our personal and professional lives,” argued ENISA executive director, Juhan Lepassaar.
“Understanding the distribution of cyber-threats, motivations, trends and patterns, as well as their potential impact, is crucial if we want to improve the cybersecurity of the critical infrastructures involved."
However, the agency acknowledged that its visibility into the threat landscape is limited to publicly reported incidents.
“Such disclosed incidents on which ENISA based its analysis and conclusions however are likely to under-represent reality if non-disclosed ones outweigh those made public,” it cautioned.