Cyber-attacks: European Union extends sanctions and legal framework

On 12 May, the Council of the European Union decided to prolong the EU’s sanctions over cyber-attacks threatening the EU and its member states for a further year, until 18 May 2026. The legal framework for these measures is extended for three years until 18 May 2028.

The legal framework allows the EU to impose targeted restrictive measures on persons or entities involved in cyber-attacks which cause a significant impact, and constitute an external threat to the EU or its member states. Restrictive measures can also be imposed in response to cyber-attacks against third states or international organisations.

“Today’s decision confirms the willingness of the EU and its member states to provide a strong and sustained response to persistent malicious cyber activities targeting the EU, its member states and partners,” says a press release by the Council of the EU.

Restrictive measures currently apply to 17 individuals (mainly officers from the. GRU, the foreign military intelligence agency of the General Staff of the Armed Forces of the Russian Federation) and four entities (two GRU entities from Russia, one from China and one from North Korea).

The sanctions include an asset freeze and the provision of funds or economic resources, directly or indirectly, to them or for their benefit is prohibited. Additionally, a travel ban to the EU applies to the natural persons listed.

These individual listings will continue to be reviewed every 12 months.

Find out more

Press release