As Europeans spend more of their lives online, the European Union is using October’s European Cybersecurity Month to raise awareness of common online threats, with a particular focus this year on phishing scams, the Commission said on Tuesday.
What the Commission announced
The annual campaign, coordinated by the European Union Agency for Cybersecurity (ENISA), the European Commission and EU countries, gathers hundreds of public and private partners across Europe and beyond for events including conferences, workshops, trainings, webinars and presentations. The activities aim to raise awareness, share good practices and provide citizens and organisations with tools to recognise and defend against cyber threats.
This year’s campaign highlights phishing — deceptive attempts to trick individuals into revealing sensitive information such as passwords or bank account details — which the Commission described as the primary method used for initial intrusion in cyberattacks. The Commission illustrated the risk with an example of a consumer who followed a fraudulent banking text and later discovered funds had been taken from her account.
The Commission reiterated that cyberattacks can be used to steal data, spy on users, disable or manipulate computers, and target not only personal devices but entire networks. Threat actors can range from individual hackers and criminal groups to state-supported actors, the announcement said.
Why it matters
The Commission framed the campaign as part of broader EU efforts to strengthen resilience against cyber threats and to protect citizens and organisations. Raising public awareness on threats such as social engineering and phishing is presented as a key way to reduce successful attacks and their impact on people’s finances, privacy and access to services.
At the policy level, the Commission noted its ongoing work on EU cybersecurity rules. In January 2026 it proposed a revision of the Cybersecurity Act aimed at strengthening European capabilities and resilience. The proposed changes target the security of information and communication technology supply chains and seek to ensure that digital products placed on the EU market are secure by design, according to the Commission’s summary.
What happens next
The campaign runs throughout October and offers citizens and organisations a programme of events organised by ENISA, the Commission and national partners. Participants can attend activities intended to improve practical skills and knowledge about recognising phishing, protecting accounts, and avoiding social engineering techniques.
Separately, the Commission’s January 2026 proposal to revise the Cybersecurity Act remains a legislative initiative. The announcement did not provide further procedural details or timelines. EU institutions and member states will handle the proposal through the usual legislative process if they choose to advance it.
The Commission encouraged participation in Cybersecurity Month activities as part of a wider strategy to bolster digital security across the EU, emphasising awareness-raising and capacity-building alongside regulatory measures.
Source: European Commission press release
