During the first half of 2026, the Ukrainian government's computer emergency response team CERT-UA recorded and processed 3,137 cyber incidents. This is 8% more than in the second half of 2025, when 2,909 cases were registered.
During the first half of 2026, the Ukrainian government's computer emergency response team CERT-UA recorded and processed 3,137 cyber incidents. This is 8% more than in the second half of 2025, when 2,909 cases were registered.
This is stated in the report "Cyber Threats: Ukraine" for the first half of 2026. CERT-UA emphasizes that the statistics presented reflect only those events that were detected and processed by specialists, and are not an exhaustive assessment of all cyberattacks in the country. The increase in the number of recorded events also does not indicate an automatic increase in successful attacks, because the indicators are influenced by the increase in the ability of protection systems to detect threats at early stages.
The vast majority of recorded incidents are of medium severity:
Critical level: 1 case (in H2 2025 — 0).
High level: 4 cases (-20% compared to 5 in H2 2025).
Average level: 2,898 cases (+0.1% compared to 2,895 in H2 2025).
Low: 234 cases (+2500% growth compared to 9 in H2 2025).
The main targets for hackers in the first half of 2026 remain government and critical structures:
Local authorities — 37% of all incidents (in H2 2025 — 38%).
Government organizations — 22% (in H2 2025 — 20%).
Security and defense sector — 9% (in H2 2025 — 12%).
Energy sector — 8% (in H2 2025 — 6%).
These four main types of incidents account for almost 84% of the total:
Malicious software distribution (MSD): 33% (in H2 2025 — 36%).
Social engineering: 23% (in H2 2025 — 31%).
SLE infection: 15% (in H2 2025 — 12%).
System compromise and destructive interference: 4.5% (in H2 2025 — 3.4%).
The distribution of threat types indicates that the main initial attack vectors remain phishing messages with malicious content, social engineering, and credential theft.
CERT-UA experts note that high rates of malware distribution do not mean the same number of successful infections, since most mailings are blocked by email services, security tools, or the most attentive users.
