In the second quarter of 2026 (Q2), 162 new cyber operations were added to the database: a 14% decrease compared to the previous quarter. The number of operations has thus continued to decline following a peak in activity in mid-2025; it is currently 9% below the long-term quarterly average. Overall, Q2 was heavily influenced by cyber operations carried out in the context of the conflict between Iran, the US, Israel, and the Gulf States.

With 51 incidents, the United States remains the most frequently targeted country, accounting for nearly one-third of all recorded incidents. The ongoing conflict with Iran has been accompanied by an increase in attacks on US critical infrastructure. Meanwhile, at 37 incidents, the number of attacks against EU Member States declined significantly, falling by 18% compared to the previous quarter. Germany and France were the most frequently targeted EU Member States, with 11 incidents each, followed by Spain with 4 incidents; together, these countries accounted for two-thirds of all attacks on EU members.