In the first quarter of 2026 (Q1), 187 cyber operations were added to the database. Although this represents a 10% decline from the previous quarter, the volume of incidents has returned to the long-term quarterly average, after a peak in activity in 2025 was observed.

With 45 operations, the United States accounts for nearly a quarter of all recorded incidents in Q1 2026. This makes it by far the most frequently targeted country. However, despite the start of US-led military operations against Iran on 28 February, there has been no measurable deviation from the long-term quarterly average in terms of operations directed against the US.