On 3 June 2026, the three European Supervisory Authorities — the EBA, EIOPA and ESMA — published their first joint report on major ICT-related incidents reported under DORA for the 2025 financial year (JC 2026 16). It is the first time European supervisors have had a consolidated view of significant incidents across the entire EU financial sector. The report sets out a factual picture: 3,383 major incidents, a third originating from third parties, a third with cross-border impact. Here is what French financial entities must take from it.
What this first report covers
Regulation DORA (EU) 2022/2554 has applied since 17 January 2025. It requires financial entities to notify their competent national authority of major ICT-related incidents in three stages: initial notification within four hours, an intermediate report within 72 hours, and a final report within one month. France has designated the ACPR (Autorité de Contrôle Prudentiel et de Résolution) for entities under prudential supervision and the AMF for crypto-asset service providers.
The ESAs' report covers incidents for which a final report had been filed by 5 February 2026. Approximately 15 per cent of incidents notified in 2025 had not yet had a final report submitted by that date: they are excluded from the analysis. The published figures therefore slightly understate the actual 2025 total, but they constitute the official baseline available.
3,383 incidents: the sectors that bear the burden
The ESAs recorded 3,383 major ICT incidents for 2025, an average of 0.18 major ICT-related incidents per DORA-covered entity (source: JC 2026 16, ESAs, 3 June 2026). That figure is a supervisory baseline, not a ceiling: it reflects only what was correctly classified and notified according to the thresholds set out in the regulatory technical standards (RTS).
The credit and payments sectors account for the majority of incidents. This is not surprising: these entities operate the most exposed infrastructure, process the highest transaction volumes and are directly targeted by fraud and opportunistic attacks. The ACPR stepped up its formal DORA inspections during the second half of 2025.
A third of incidents attributable to third parties
Nearly a third of major incidents originated from a third-party failure: ICT service providers, other financial entities or infrastructure operators. This is consistent with the very logic of the regulation, whose Article 28 requires a formalised approach to managing ICT third-party risk. It confirms that dependency mapping and contractual provisions remain a concrete area of exposure, as we set out in our analysis DORA eighteen months on: persistent gaps in ICT governance.
A concrete example: a payment institution delegates its strong-authentication infrastructure to a third-party provider. That provider experiences a two-hour API outage. The entity can no longer authenticate its customers: the incident meets DORA's qualification criteria (impact on service continuity, duration exceeding the RTS thresholds). It must be notified even though the entity itself made no operational error. The post-incident analysis must document contractual and technical mitigation measures: was the incident covered by the business continuity plan? Did the provider notify within the agreed timeframe? Is the exit clause exercisable?
A third with cross-border impact
Approximately a third of reported incidents had an impact on operations or customers in more than one Member State. This result illustrates the genuine interconnectedness of the European financial sector and justifies the choice of a single regulation rather than a patchwork of national frameworks.
For French entities with cross-border activities — branches, European customer bases, exposure to counterparties established in other Member States — this figure raises a practical question: is your notification procedure calibrated for an incident whose impact extends beyond French borders? The ESAs flag reporting practices that are still divergent across sectors and jurisdictions. This is not a minor procedural discrepancy: insufficient or late notification in this context exposes an entity to a sanction from its competent authority, regardless of the quality of the technical response.
What resilience looks like in figures
Two thirds of incidents caused little or no disruption to clients and transactions, in the ESAs' assessment. This positive reading requires qualification: it indicates that detection and containment capabilities are working in the majority of cases, not that risk is under control. Incidents that did not reach the threshold of visible disruption are precisely those that were detected and contained quickly. The others were notified.
The ESAs also flag AI-driven attack tools as an emerging aggravating factor. Attackers now have tools that accelerate vulnerability discovery and the customisation of intrusion vectors. This signal anticipates a likely deterioration in the ratio of incidents detected to incidents prevented, should defensive capabilities fail to keep pace.
What French financial entities must do now
This first report establishes benchmarks against which your DORA programme can be measured. Three points deserve immediate review.
Revisit your criteria for classifying major ICT incidents. The RTS set precise thresholds: number of clients affected, value of transactions disrupted, duration of unavailability. If you managed incidents in 2025 without triggering the notification procedure, check retrospectively whether those incidents met the criteria. Under-notification can be sanctioned by the ACPR in the same way as a poorly managed incident.
Audit your critical third-party dependencies. A third of sector incidents originate from third-party failures, and your DORA mapping must cover all your ICT service providers with access to critical functions. Article 28 of the regulation requires a formalised third-party risk management policy and compliant contractual registers: this is a point the ACPR prioritises during inspections.
Test your notification procedure against a realistic scenario. The initial notification is due within four hours of an incident being classified. In an incident involving a third party, the chain of communication between your detection team, your ICT officer, your senior management and your competent authority can easily exceed that window if it has never been exercised. A one-hour tabletop exercise is enough to identify the bottlenecks.
To bring your incident response procedures and DORA regulatory notification circuits up to the required standard, our incident response service covers plan preparation, crisis exercises and decision traceability for the audit trail.