Europe and the Middle East Threat Landscape

^{2024 STATE OF THE PHISH: EUROPE AND THE MIDDLE EAST \}^REPORT

Europe and the Middle East Threat Landscape

The regional threat landscape largely followed global trends last year. Business email compromise fell overall, but non-English-speaking countries saw an increase. This could be linked to the rise of generative AI tools such as ChatGPT, which can be used to write convincing email lures in multiple languages. Similar trends were visible in other non-English-speaking countries worldwide. Overall, 75% of organisations saw at least one successful phishing attack, down from 88% in 2022.

The region saw slightly more TOAD attacks—70% vs the global average of 67%. 84% of Swedish organisations experienced a TOAD attack—the highest level in the region.

As with our global findings, organisations in Europe and the Middle East reported an increase in negative consequences from successful attacks. Financial penalties increased by 122%. This was slightly lower than the global figure, which may point to GDPR fines already being levied in previous years.

^{2024 STATE OF THE PHISH: EUROPE AND THE MIDDLE EAST \}^REPORT

Percentage Affected by Targeted Attacks

^{2024 STATE OF THE PHISH: EUROPE AND THE MIDDLE EAST \}^REPORT

Ransomware

Ransomware remains a serious threat to organisations in the region; both attacks and infections have risen in the past year. However, the details vary between countries.

Italy, for instance, reported the largest increase in successful ransomware infections, from 44% in 2022 to 71% in 2023—despite facing the same level of attacks as everyone else. This prompted the Italian authorities to issue a warning in June about the growing number of ransomware attacks exploiting a VMware bug.

Sweden, meanwhile, experienced the highest level of attempted ransomware attacks in the world, with 92% of its organisations being targeted.

This may be related to the fact that, in a previous survey, 74% of Swedish respondents cited credential theft as the biggest cause of data breaches. Prioritising defense against these attacks may reduce the likelihood of follow-on activity, such as ransomware.

Email-Based Ransomware Attack Trend

^{2024 STATE OF THE PHISH: EUROPE AND THE MIDDLE EAST \}^REPORT

Ransomware

Ransomware Infection Trend

On the other hand, only three countries—Germany, UAE and the U.K.—showed greater willingness to pay. Germany also had the highest proportion that paid a ransom (93% vs 54% global average).

This strategy seemed to work for German and UAE organisations, which reported much higher rates of system and data recovery after a single payment. However, it also came at a cost, as 85% of German organisations reported a successful ransomware infection—the highest level in the region—suggesting a link between their readiness to pay and the intensity of targeting.

^{2024 STATE OF THE PHISH: EUROPE AND THE MIDDLE EAST \}^REPORT

Ransomware

U.K. organisations, however, did not fare so well, suffering the highest rates of repeat infection. About 14% experienced 10 or more infections, compared to 5% globally. This shows that paying ransoms does not guarantee immunity from future attacks—and may even encourage them.

Globally, Dutch companies saw the least positive results from paying; 40% reported that they never got their data back, compared to 16% globally. This suggests that some ransomware groups may not honor their promises or may not always have the ability to restore data.

Percentage of Organisations that Paid a Ransom

^{2024 STATE OF THE PHISH: EUROPE AND THE MIDDLE EAST \}^REPORT

Ransomware

On a positive note, cyber insurance coverage levels have improved, providing some financial relief.

The only exception was France, where the percentage of fully or partially covered organisations dropped from 87% in 2022 to 76% in 2023. This is likely due to France’s largest insurer announcing that it will no longer cover ransomware attacks.