Attacks against energy, water and other critical infrastructure in the EU

Due to the technical advancement, Information and Communication Technologies have been a critical part of our life a while resulting in better conformity and faster administration. On the other hand, threat space has expanded with the digitalization and altered to be more complicated as an undesired effect by this advancement. Recognizing this fact as an outcome of the Estonian cyberattack campaign, the European Union is consciously strengthening its cyber-defence. However, legislation evolves slowly, so after an eleven-year delay, the Network and information security (NIS) Directive came to the effect. The NIS Directive made advances to the world of critical infrastructures in the European Union, but on the other hand, threats have evolved, too. From these two threads comes the question of whether the nature of the incidents has changed or not. This work tries to find the answer with the review of publicly available cyber-incidents that occurred in the last ten years, focusing on the European Union, according to the Annex II of the NIS Directive. Additionally, it aims to give the basis for a public register regarding the incidents affecting one or more operators of these Essential Services.