ESAs publish first DORA major ICT incident report
The EBA, EIOPA and ESMA published the first annual overview of major ICT-related incidents in the EU financial sector under DORA.
The inaugural DORA incident report highlights that ICT risks in EU finance are increasingly borderless and interconnected. It signals that supervisors now have systemic visibility into incident frequency, severity and contagion, raising the bar for incident detection, classification and reporting.
Establishes a baseline for supervisory expectations on operational resilience and shapes future thematic reviews and enforcement priorities under DORA.
Action Required
Benchmark internal ICT incident profile against ESA findings and reassess third-party concentration and cross-border ICT risk controls.
First systemic EU-wide view of ICT incidents under DORA will drive supervisory scrutiny and benchmarking across financial entities.
ICT and third-party resilience risk elevated. Review DORA incident classification, reporting timelines and concentration exposures against ESA findings; update RCSA controls for cross-border ICT dependencies.
“The European Supervisory Authorities (EBA, EIOPA and ESMA) today published their first annual overview of major ICT-related incidents in the EU financial sector based on the DORA reporting mechanism, noting ICT risks are increasingly borderless and interconnected.”
Published: 2026-06-03