Which European cybersecurity campaigns are worth studying? The strongest cases split into public awareness work, such as the UK's three random words advice and Belgium's Safeonweb reporting address, and responses to attacks, such as Norsk Hydro and Ireland's HSE. This page covers 12 cases, each tied to a named outlet, including two regulator fines.
Companion to The 25 Cybersecurity Campaigns That Actually Broke Through in 2026. Part of EPR's Cybersecurity pillar. Originally published October 2026. Updated October 13, 2026.
How was this list of European cybersecurity cases compiled?
This list uses only cases that could be traced to a regulator, an agency or a named news or trade outlet. Agency and company statements are labelled as such. The UK is included as a European country, and the cases run from 2012 to 2024.
How do national agencies make cybersecurity advice stick?
Three cases show agencies turning technical advice into one repeatable message.
1. UK Cyber Aware tells people to use three random words
The National Cyber Security Centre (NCSC) launched the cross-government Cyber Aware campaign with the Home Office, the Cabinet Office and the digital culture department, with advice to use three random words for passwords, per Friends Against Scams. NCSC polling in April 2021 found 15% of people used a pet's name as a password and 6% used "password" in theirs, per Global Security Mag. In August 2021 the NCSC explained that complexity rules produce more predictable passwords, LBC reported.
Lesson: The NCSC gave one rule that people could remember, then published the reasoning behind it.
2. The NCSC's CyberSprinters game for ages 7 to 11
The NCSC launched CyberSprinters, an online game with the Department for Education in which children race the clock to answer cyber security questions, with a resource pack for primary schools and youth organisations, per the NCSC Annual Review 2021. This is the agency's own description.
Lesson: The agency used a game format for an audience that adult password advice does not reach.
3. ENISA runs a pan-European Cybersecurity Month
The first European Cyber Security Month ran in October 2012 as a pilot in eight countries, supported by ENISA and the European Commission, per Global Security Mag. Help Net Security reported the pilot reached 1,986,270 people on Facebook by mid-month. The EU's digital skills portal says more than 525 activities in 36 countries have taken place since, per its good-practice entry.
Lesson: A fixed month gave national agencies one shared hook, and ENISA supplied the logo in 23 languages.
How do reporting schemes turn the public into early warnings?
Three cases show agencies asking the public to forward scams instead of only avoiding them.
4. The NCSC asks the public to report scam emails
Computer Weekly reported that the NCSC's scam email reporting service had caught 10 million phishing attempts, as the government launched a Cyber Aware advertising push across broadcast, online and billboards. The same report said recorded offences linked to unauthorised access to personal information rose 161% in 2021 in England and Wales.
Lesson: A reporting address gave people an action to take, and the agency could count the result.
5. Belgium's Safeonweb turns citizens into reporters
The Centre for Cybersecurity Belgium (CCB) asks people to forward suspicious messages to verdacht@safeonweb.be. Almost ten million were forwarded in 2023, up from six million in 2022, and 28% of Belgians had reported a scam, per the Brussels Times. In 2024 more than 9 million were forwarded and a CCB survey found 44% of Belgians forward messages, per the CCB.
Lesson: The CCB's own director told VRT the volume showed public trust, and also showed that phishing remained high.
6. Belgium's Outsmart a Phisher adds banks to the message
The CCB, the banking federation Febelfin and the Cyber Security Coalition launched the Outsmart a Phisher campaign on November 16, 2021, per Febelfin. Febelfin cited 67,000 fraudulent phishing transactions worth a net 34 million euros in 2020, and the CCB cited 3.7 million suspicious messages forwarded that year and 1.3 million links blocked.
Lesson: Banks and the agency shared one call to action, so the public heard the same instruction from both.
Can public and private groups fight ransomware together?
One case shows police and companies sharing a single website for victims.
7. No More Ransom gives victims free decryption tools
The Dutch National Police, Europol, Kaspersky and Intel Security launched No More Ransom in July 2016, per Kaspersky. By its third anniversary Europol said the project had helped more than 200,000 victims and prevented $108 million in ransom payments, with visitors from 188 countries, BankInfoSecurity reported. These are Europol figures. Verdict noted that the US was not a partner.
Lesson: A single portal in many languages gave victims one place to go, and gave partners one number to report.
How do companies communicate while under cyber attack?
Three cases show how an organisation spoke while its systems were down.
8. Norsk Hydro briefs the press daily during an attack
Norsk Hydro was hit by ransomware in March 2019. Microsoft reported that executives held daily press conferences, posted updates to Facebook, let journalists into control rooms and launched a new website in the first week. InCyber reported the company's share price did not fall despite tens of millions of dollars in lost business.
Lesson: Norsk Hydro's media relations chief told the industry it wanted others to learn from the incident, per WaterISAC's summary of Microsoft's account.
9. Maersk's chairman details a 10-day rebuild at Davos
Maersk chairman Jim Hagemann Snabe told the World Economic Forum in January 2018 that the company reinstalled 4,000 servers, 45,000 PCs and 2,500 applications in 10 days after NotPetya, at a cost of $250 million to $300 million, per SC Magazine. Supply Chain Dive reported Maersk saw a 20% drop in volume while operating essentially without IT.
Lesson: Snabe gave exact numbers and described the company as average on cybersecurity, which turned a loss into a public case study.
10. Ireland's HSE refuses to pay a $20 million ransom
Ireland's Health Service Executive was hit by Conti ransomware on May 14, 2021. The Irish Comptroller and Auditor General's report said the demand was almost $20 million and that the HSE did not engage with the attackers or pay, per the audit report. Costs reached 80 million euros, Infosecurity Magazine reported, and a PwC review found the attack began with one staffer opening a malicious file in a phishing email, per The Register.
Lesson: The government announced a no-payment position on day one, and an independent review later published the causes.
What do regulators fine after a European data breach?
Two UK Information Commissioner's Office (ICO) penalties show what regulators penalize after a breach.
11. TalkTalk receives a record ICO fine of £400,000
The ICO fined TalkTalk £400,000 on October 5, 2016, for an attack between October 15 and 21, 2015, that exposed the data of 156,959 customers, Sharecast reported. Bank details were accessed in 15,656 cases, per Advisen. Information Commissioner Elizabeth Denham said the case showed cyber security is a boardroom issue.
Lesson: The ICO tied the penalty to basic measures that were available, so the story became a governance failure and not only a hack.
12. British Airways' £183 million fine falls to £20 million
The ICO fined British Airways £20 million on October 16, 2020, over a 2018 breach affecting about 429,612 customers and staff, down from a £183.39 million proposal in July 2019, per law firm Mayer Brown. The attack went undetected for more than two months, and British Airways said it alerted customers as soon as it became aware and apologized, per City AM.
Lesson: The final fine reflected representations from the airline and the pandemic, per Mayer Brown, so a proposed penalty is not the final one.
What do these 12 European cybersecurity cases share?
The 12 cases share one pattern: the public agencies gave people a single action to take, and the organizations hit by attacks were judged on how openly they described the failure.
| Group | Cases | What the reported evidence shows |
|---|
| Advice that sticks | Cyber Aware, CyberSprinters, ECSM | One rule, one game or one month that others could repeat |
| Public reporting | NCSC reporting, Safeonweb, Outsmart a Phisher | Millions of forwarded messages and blocked links |
| Joint action | No More Ransom | 200,000 victims helped, per Europol |
| Open communication | Norsk Hydro, Maersk, HSE | Exact numbers and early statements about the incident |
| Regulator penalties | TalkTalk, British Airways | Fines tied to basic security failures |
What should cybersecurity communicators take from these cases?
Cybersecurity communicators should pick one action for the public and one set of numbers for the press, and publish both early. For related coverage, see cybersecurity public relations, how to build a cybersecurity crisis communications plan and how Apple, CISA and the UK NCSC built cybersecurity awareness.
