text: www.enisa.europa.eu European Union Agency For Network And Information Security

text: Annual Report Trust Services Security Incidents 2017

text: Regulation (EU) No 910/2014

text: of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive

text: , can be consulted at https://eurlex.europa.eu/eli/reg/2014/910/oj

text: Notification Trust service Informing provider Summary reporting 2 Customer 1 1 affected National Other relevant supervisory authorities body 3 5 4

text: National supervisory bodies abroad, EC Public and ENISA

text: Figure 1: Overview of reporting flows in

text: Article 19

text: The “Incident reporting framework for eIDAS

text: Article 19

text: “ is available at https://www.enisa.europa.eu/publications/article19incident-reporting-framework

text: Note that one additional security incident was reported, but excluded from the analysis, because it had no impact.

text: ENISA Annual Report Telecom Security Incidents 2017 https://www.enisa.europa.eu/publications/annual-report-telecom-security-incidents-2017

text: ROCA (Return of Coppersmith Attack) is a vulnerability discovered by academic researchers in a cryptographic library, used in a wide range of cryptographic chips and was publicly disclosed in October 2017. The issue was that the library generated RSA key pairs in such a way that an attacker could compute the corresponding private key from the corresponding public key. In many settings and implementations of RSA the public key is published or widely known, but the private key is supposed to remain a secret. More info see https://crocs.fi.muni.cz/public/papers/rsa_ccs17

identifier: Annual Report Trust Services Security Incidents 2017

title: Annual Report Trust Services Security Incidents 2017

text: Annual Report Trust Services Security Incidents 2017 OCTOBER 2018

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Contact

text: For contacting the authors please use resilience@enisa.europa.eu. For media enquires about this paper, please use press@enisa.europa.eu.

text: Acknowledgements

text: For the completion of this report ENISA has worked closely with a group of experts from Supervisory Bodies from across Europe. Listing the organizations (in no particular order): ILNAS (LU), CERT LV(LV), Bundesnetzagentur (DE), MCA (MT), NKOM (NO), ANSSI (FR), Austrian Regulatory Authority for Broadcasting and Telecommunications RTR (AT), Ministry of Digital Affairs (PL), GNS (PT), Agency for Digitisation (DK), Radiocommunications Agency (NL), FPS Economy (BE), EETT (GR), RRT (LT), FICORA (FI), Communications Regulation Commission CRC (BG), Agenzia per l'Italia Digitale (IT), National Media and Infocommucations Authority (HU), ICO (UK), Ministry of Communications and Informational Society (RO), National Security Authority NSA (SK), Ministry of Energy, Tourism and Digital Agenda (ES), Swedish Post and Telecom Authority PTS (SE), Ministry of Economy, Entrepreneurship and Crafts (HR), Ministry of the Interior (CZ), Estonian Information System Authority RIA (EE), DCCAE (IE), Ministry of Transport, Communications and Works (CY), Ministry of Public Administration, Information Society Directorate (SI), National Authority for Electronic Certification and Cyber Security (AL), MINGO (HR), Office for Communications AK (LI), European Commission (as observer)

text: Legal notice Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice © European Union Agency for Network and Information Security (ENISA), 2018 provided the source is acknowledged.

text: ISBN: 978-92-9204-258-5, DOI: 10.2824/835041

text: Table of Contents

text: Executive Summary 4

text: 1. Introduction 6

text: 2. Background 7 eIDAS regulation and

text: Article 19

text: 7 Legal text of eIDAS

text: Article 19

text: 7 Incident reporting flows in

text: Article 19

text: 8 Security incident reporting 9 2.4.1 Services in scope of reporting 9 2.4.2 Security incidents 9 2.4.3 Reportable security incidents 9 2.4.4 Annual summary reporting threshold 10

text: 3. Analysis of reported security incidents 11 Trust services affected 11 Root causes of security incidents 12 Severity of security incidents 12 Security incidents with cross border impact 13

text: 4. Examples of reported security incidents 14 The ROCA case 14

text: 5. Conclusions 16

text: Executive Summary

text: Electronic trust services are a range of services around digital signatures, digital certificates, electronic seals, timestamps, etc. which are used in electronic transactions, to make them secure. eIDAS , an EU regulation, is the EU wide legal framework ensuring interoperability and security of these electronic trust services across the EU. One of the goals of eIDAS is to ensure that electronic transactions can have the same legal standing as traditional paper based transactions. eIDAS is important for the European digital market because it allows businesses and citizens to work and use services across the EU. The eIDAS regulation was adopted in July 2014 and came into force in 2016. Article 19 of the eIDAS regulation sets security requirements for trust service providers. National supervisory bodies have to supervise the trust service providers in their country to ensure that they fulfil these requirements. Cooperation and agreement on how to do this in practice is important not only to create a level playing field for providers operating out of different EU countries, but also to protect transactions based on these services. If there is, for instance, a cyber-attack on a trust service provider in one Member State, then this could have an impact on organizations in other parts of the EU who rely on the provider’s trust services. An important part of

text: Article 19

text: is the mandatory security breach notification requirements: Trust service providers must notify the national supervisory body about security breaches, if there is a significant impact on the trust service(s) they provide.

text: Article 19

text: requires national supervisory bodies to inform each other and ENISA if there is cross-border impact. Annually, the national supervisory bodies send annual summary reports about the notified breaches to ENISA and the European Commission. This document, the Annual Report Trust Services Security Incidents 2017, marks the second round of security incident reporting for the EU’s trust services sector For 2017, the national supervisory bodies reported 13 security breaches with a significant impact on trust services. We can draw the following conclusions:  Notification increase: The number of notified security breaches increased significantly, in comparison to the previous year. This is not a sign of decreasing security, but rather shows that the implementation of the breach reporting requirements is maturing. Trust service providers are more aware of their breach reporting obligations and are becoming more familiar with the procedure. This leads to more notifications to the supervisory bodies.  E-signatures and e-seals most affected: Almost half of the notified breaches, 43%, involve certificates for electronic signatures and electronic seals.  Most common causes are system failures, third party failures: System failures, third party failures are both responsible for 36% of the breaches. Human errors are more rare (21%). Only 7% of the breaches are caused by malicious actions.  Many security breaches had cross-border impact: Almost half of the notified breaches, 46%, had an impact across borders. This shows that indeed the EU trust services sector is cross-border. Many providers (and their suppliers) are offering services across the EU. Half those were severe, i.e. 50% the cross-border incidents had the highest severity rating (5- disastrous).  A third of the breaches were due to ROCA: A number of notified breaches had the same underlying cause (the ROCA case). The general conclusion is that, particularly for security supervision of trust services, cross-border collaboration and information exchange between EU Member States are very important and are starting to produce concrete results

text: that are of value to the community. The eIDAS regulation, and

text: Article 19

text: in particular, provides the legal basis for collaboration and information exchange between the supervisory bodies. Detailed discussions about security issues and supervision of the sector take place inside the ENISA

text: Article 19

text: expert group, which is an informal group of experts from national supervisory bodies focusing on the practical implementation of

text: Article 19

text: 1. Introduction

text: According to Article 19 of the eIDAS Regulation, Electronic Trust Service Providers in the EU have to notify the national supervisory bodies in their country about security incidents. Annually the supervisory bodies send summaries of these incident reports to ENISA. Subsequently ENISA publishes an aggregated overview of these security incidents. This document gives an aggregate overview of the reported security incidents. This annual report marks the second round of security incident reporting in the EU’s trust services sector, covering the security incidents of 2017. This document only contains aggregated and anonymized information about incidents and does not include details about individual countries or individual trust service providers. Detailed discussions about the reported security incidents take place in the ENISA

text: Article 19

text: Article 19

text: 2. Background

text: In this section, we explain in more detail the background and policy context of this annual report.

text: The eIDAS regulation and

text: Article 19

text: The eIDAS regulation was adopted in July 2014 and came into force in 2016. It is a legal framework that ensures interoperability of electronic trust services across the EU, creating a single market for such services. One of the goals of eIDAS is to ensure that electronic transactions have the same legal standing as traditional paper based transactions, allowing organizations to move away from expensive and cumbersome paper-based processes. eIDAS is important for the European digital market because it allows businesses and citizens to use online and digital services across the EU, without the need to obtain a new electronic identity or trust service product each time. The idea is that, for example, a digital signature from a Spanish citizen, created with an Austrian smartcard, can be validated and accepted by, say, a Greek company. Article 19 of the eIDAS regulation, contains the security requirements for trust service providers and the security breach notification requirements. In a nutshell,

text: Article 19

text: requires that trust service providers assess risks, take appropriate security measures, and notify security incidents to the supervisory body.

text: Article 19

text: also puts information sharing obligations on supervisory authorities vis-a-vis other supervisory bodies in the EU. Cooperation and agreement between EU member states on how to implement

text: Article 19

text: and how to do security supervision is very important not only to create a level playing field across the EU, but also to avoid fraud and cyber-attacks. The Diginotar case of 2011 offers a good example of how a single security incident at one European certificate authority had an impact across borders, even globally.

text: Legal text of eIDAS

text: Article 19

text: We include the text of

text: Article 19

text: verbatim for the sake of reference:

text: Article 19

text: : Security requirements applicable to trust service providers Qualified and non-qualified trust service providers shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust services they provide. Having regard to the latest technological developments, those measures shall ensure that the level of security is commensurate to the degree of risk. In particular, measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of the adverse effects of any such incidents. 2. Qualified and non-qualified trust service providers shall, without undue delay but in any event within 24 hours after having become aware of it, notify the supervisory body and, where applicable, other relevant bodies, such as the competent national body for information security or the data protection authority, of any breach of security or loss of integrity that has a significant impact on the trust service provided or on the personal data maintained therein. Where the breach of security or loss of integrity is likely to adversely affect a natural or legal person to whom the trusted service has been provided, the trust service provider shall also notify the natural or legal person of the breach of security or loss of integrity without undue delay.

text: Where appropriate, in particular if a breach of security or loss of integrity concerns two or more Member States, the notified supervisory body shall inform the supervisory bodies in other Member States concerned and ENISA. The notified supervisory body shall inform the public or require the trust service provider to do so, where it determines that disclosure of the breach of security or loss of integrity is in the public interest. 3. The supervisory body shall provide ENISA once a year with a summary of notifications of breach of security and loss of integrity received from trust service providers.” We also quote a part of Article 17 (6) of the eIDAS regulation, which asks supervisory bodies to provide the Commission with a summary of the notified breaches: By 31 March each year, each supervisory body shall submit to the Commission a report on its previous calendar year’s main activities together with a summary of breach notifications received from trust service providers in accordance with

text: Article 19(2)

text: . Finally we report preamble 39 of the eIDAS regulation which explains that one of the reasons for annual summary reporting to ENISA and the Commission is to assess the effectiveness of the breach reporting mechanism itself: To enable the Commission and the Member States to assess the effectiveness of the breach notification mechanism introduced by this Regulation, supervisory bodies should be requested to provide summary information to the Commission and to European Union Agency for Network and Information Security (ENISA).

text: Incident reporting flows in

text: Article 19

text: Article 19

text: requires trust service providers to assess risks, take appropriate security measures to mitigate and notify the supervisory bodies of security breaches with a significant impact on the trust services. It requires the supervisory body to inform other Member States and ENISA when a breach concerns other Member States. Moreover, each year supervisory bodies have to provide ENISA and the European Commission with a summary of breach notifications of received from their trust service providers. The diagram below shows the full picture and the different reporting flows. We explain the arrows step-by-step:

text: 1. At step 1 (see arrow 1 in the diagram) the trust service provider notifies the national supervisory body of a security breach with a significant impact on the trust service provided or on the personal data maintained therein. This must happen without undue delay, and within 24 hours after the trust service provider became aware of the security breach. The provider needs to notify also to other relevant authorities, such as e.g. the national data protection authority (DPA), the national competent authority for information security, etc., where applicable. 2. The trust service provider also notifies the natural or legal person to whom the trust service was provided, i.e. the customer affected by the security incident, without undue delay (arrow 2). 3. If disclosure of the breach is in the public interest then the supervisory body may decide to Inform the public or require the trust service provider to do so (arrow 3). 4. The national supervisory body informs relevant supervisory bodies abroad and ENISA, when a security incident involves two or more Member States (arrow 4). 5. Annually the national supervisory body sends a summary reporting to ENISA and the Commission (arrow 5).

text: Security incident reporting

text: In 2014, after eIDAS was adopted, and under the auspices of the European Commission, ENISA formed an expert group with experts from competent authorities and national supervisory bodies to agree on the technical and practical details of implementing

text: Article 19

text: . In 2015 this group reached agreement about a non-binding technical document describing an incident reporting framework implementing

text: Article 19

text: in practice . The group also agreed to use the reporting tool (called CIRAS-T) developed by ENISA to facilitate the annual summary reporting. Below we briefly explain the key parts and terminology of the overall incident reporting framework.

text: 2.4.1 Services in scope of reporting

text: In scope of reporting are qualified and non-qualified trust-service providers offering the following services:  creation, verification, and validation of electronic signatures, electronic seals or electronic time stamps, electronic registered delivery services and certificates related to those services  creation, verification and validation of certificates for website authentication  preservation of electronic signatures, seals or certificates related to those services, as defined in Article 3 of the eIDAS regulation, as an electronic service normally for remuneration

text: 2.4.2 Security incidents

text: eIDAS and

text: Article 19

text: mentions security incidents, breaches of security, loss of integrity, breach notifications. In the rest of this document, in line with the terminology used in the above-mentioned incident reporting framework, we abbreviate and use the term security incident to encompass both breaches of security and loss of integrity:

text: Security incident: A breach of security or loss of integrity with an impact on the security of the trust service provided.

text: For instance, the flooding of a server room due to heavy rains, causing downtime of an online validation service offered by the trust service provider, would be a security incident.

text: 2.4.3 Reportable security incidents

text: Security incidents, which have to be notified to the supervisory body are those incidents, which had a significant impact on the trust service provided or on the personal data maintained therein. Each country takes a different

text: national approach to this, based on national circumstances, depending on national circumstances, the sector, the size of the population, etc.

text: 2.4.4 Annual summary reporting threshold

text: While national reporting thresholds are different in each country, the

text: Article 19

text: expert group agreed on a threshold for annual summary reporting, to ensure consistency in the annual summary reporting across the EU. The agreed threshold is based on the severity scale, which is introduced in the incident reporting framework. This severity scale has 5 levels:

text: 1. No impact 2. Insignificant impact: provider assets were affected but no impact on core services 3. Significant impact: part of the customers/services is affected 4. Severe impact: large part of the customers/services is affected 5. Disastrous: the entire organisation, all services, all certificates are affected

text: The members of the

text: Article 19

text: expert group agreed that security incidents rated at level 3 or higher should be included in the annual summary reporting to ENISA and the Commission.

text: 3. Analysis of reported security incidents

text: For the annual summary reporting for 2017, 13 security incidents with significant impact were reported to ENISA and the Commission . st This is only the second round of annual summary reporting, because eIDAS came into force just recently, on the 1 of July 2016. For comparison, in the first year of annual summary reporting, covering (half of 2016), only one incident was reported.

text: Trust services affected

text: Most incidents (43%) affected the creation of certificates for electronic signatures and electronic seals. The second category of services affected were the online certificates revocation services (CRL and OSCP) with 22%, and the online verification services with 21%.

text: Trust services affected by security incidents

text: 7% 7%

text: Creation of e-signatures and e-seals Certificate revocation lists

text: Verification of signatures or seals

text: Revocation of certificates for esignatures or e-seals Qualified e-signature devices

text: 22% Root causes of security incidents The most common root causes of security incidents were system failures (36%) and third party failures (36%). Malicious actions were rarely the cause of incidents (just 7% of the incidents). This graph is evidence of a larger trend in the root causes of the security incidents as system failures is the main 5 one in the telecom sector as well.

text: Root causes of TSP security incidents

text: Human error

text: Malicious actions

text: System failures Third party failures

text: Severity of security incidents Approximately half of the reported security incidents (46%) were either severe or disastrous.

text: Severity of TSP security incidents

text: 3- significant 4- severe

text: Security incidents with cross border impact

text: Almost half of the security incidents (46%) had impact across borders, in other EU Member States. This is not surprising if one considers the nature of the trust services and the single market. Supervisory Bodies (SBs) informed other Member States (MS) by initiating the cross-border incident notification procedure.

text: Cross border impact TSP security incidents

text: cross border impact

text: 46% 54%

text: no cross border impact

text: Half of the incidents with cross-border impact were rated as disastrous (level 5). This highlights the importance of cross-border collaboration and information sharing. Incidents without cross-border impact were, generally speaking, less severe.

text: Cross border impact No cross border impact 29% 50% 50% 71%

text: 3-significant impact 3-significant impact 4-severe impact 4-severe impact 5-disastrous impact 5-disastrous impact

text: 4. Examples of reported security incidents

text: In this section, we give some specific (anonymized) examples of reported security incidents. We also indicate the severity level that was indicated by the national supervisory body as part of the annual summary reporting to ENISA and the European Commission.  Malware compromised email addresses (severity level 3- significant): The computer of an employee of a trust service provider was infected by malware, via an email attachment. The malware used a word document containing a macro. The attacker downloaded a list of account email addresses and tried to retrieve authentication information from the provider’s customers via spear-phishing. The provider reacted by resetting the passwords of all employees, improved the authentication process for employees and launched an awareness and education campaign for its employees.

text:  Unavailability of Revocation Services (severity level 3- significant): A trust service provider’s revocation services were unreachable for 3 hours. This was caused due to a human error in the configuration of domain name records. The trust service provider informed the public. Afterwards the provider acknowledged the need to improve the process for detecting and resolving IT issues. The provider also analyzed the redundancy of the links for the operation of the revocation services.

text:  Certificate serial number errors (severity level 3- significant): A trust provider inserted incorrect certificate serial numbers in the certificates, due to a software bug. The bug was not detected due to insufficient testing. Hundreds of certificates had to be revoked as a result. The provider informed all affected customers. Afterwards the provider fixed the software bug and improved the testing processes.

text:  Services offline (severity level 3- significant): A trust service provider experienced multiple problems with installing a new internet connection. As a result, its customer service and all internet-facing services offered by the trust service provider were unavailable for hours. The provider notified the customers of the problem via email. As an immediate action the trust service provider rolled back to its previous internet connection.

text:  Unavailability of time stamping service (severity level 4- severe): A trust provider experienced a hardware failure in one of the components underpinning it’s time stamping server. This blocked the creation of timestamps. The provider disconnected the faulty system and informed its customers about the service unavailability. After the hardware fault was resolved and the service was restored, the provider investigated the case by analyzing event logs. The trust service provider also analyzed a number of failure scenarios for unforeseen circumstances like these and improved their failover procedures.

text: The ROCA case

text: We discuss the ROCA vulnerability in more detail, because it was a case with implications across Europe, widely discussed in press and media, and because the ROCA vulnerability was the underlying cause for a number of security breach notifications from trust service providers. From the total of 13 incidents included in the annual reports, 5 security incidents were related to ROCA.

text: It is good to highlight here that ROCA was a vulnerability that triggered the revocation of cryptographic keys and certificates by trust service providers, but there are (to our knowledge) no successful attacks or exploitations of this vulnerability (yet), besides proof of concept attacks. The impact of ROCA was different across the EU, depending on the usage scenario and the number of customers involved. This means that ROCA was mitigated by trust service providers in different ways. In some cases trust providers had to revoke a small number of certificates, while in other cases, large numbers of customers were affected, requiring even coordination by national authorities to manage the situation. Overall, across the EU, trust service providers, revoked, approximately, 18 million vulnerable certificates. Some ROCA related incidents were not even notified to the supervisory body because the impact was insignificant. The severity of the ROCA-related incidents in the annual summary reporting varied: 60% was rated at severity level 5-disastrous, 40% at severity level 3-significant (see the chart below).

text: Severity rating ROCA related incidents 3-significant

text: 4-severe 5-disastrous

text: We give some examples of incidents caused by ROCA and their impact severity:  Small number of revocations (severity 3- significant): In one country a trust service provider had to revoke a small number of impacted certificates.

text:  Update of eID cards (severity 5- disastrous): In one country the ROCA vulnerability was found to be present in hundreds of thousands of national e-ID smartcards, issued over the last 3 years. As a mitigation the national authorities decided to close the public key database in order to protect against a potential future attack. All affected electronic identity cards were suspended. The affected citizens had to update their electronic identity documents remotely or at specific service points.

text:  Electronic signatures affected (severity 5- disastrous): In one country only the qualified electronic signature part of the national eID cards was affected by ROCA. The national authority decided to revoke hundreds of thousands of certificates and issued new certificates with a longer (RSA 3072 bit) key pair. Additionally ROCA triggered a transition from RSA to ECDSA, and the usage of Extended Access Control (EAC) to secure remote issuance of qualified certificates.

text: 5. Conclusions

text: This document, the Annual Report Trust Services Security Incidents 2017, aggregates and analyses the annual summary reports from EU Member States about security breaches notified by trust service providers. We can draw the following conclusions:  The number of notified security breaches increased significantly, in comparison to the previous year. This should not be interpreted as a sign of decreasing security. Also in the first years of security incident reporting in the telecom sector there was a gradual increase of the number of reported incidents, because it takes some time for service providers to become familiar with the breach reporting obligations and the procedure.  Almost half of the notified breaches, 43%, involve certificates for electronic signatures and electronic seals.  System failures, third party failures and human errors are the main root causes. Only 7% of the breaches are caused by malicious actions.  Almost half of the notified breaches, 46%, had an impact across borders. This shows that indeed the EU trust services sector is to a large extent cross-border with suppliers and providers offering services across the EU.  Half of the incidents were rated as having a severe (level 4) or disastrous impact (level 5). Half of the crossborder incidents were rated has having a disastrous impact (level 5).  A number of notified breaches had the same underlying cause, i.e. the ROCA case. The general conclusions we can draw from this is that cross-border collaboration and information exchange are very important when it comes to supervision and ensuring the security of trust services in the EU. eIDAS provides the legal basis for collaboration and information exchange mechanisms between supervisory bodies. The sooner organizations learn about threats and incidents, the sooner they can decide the best course for mitigation. Good information exchange about threats and incidents makes mitigation easier.

text: ENISA European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece Athens Office 1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, Greece

text: PO Box 1309, 710 01 Heraklion, Greece ISBN: 978-92-9204-258-5 Tel: +30 28 14 40 9710 DOI: 10.2824/835041 info@enisa.europa.eu www.enisa.europa.eu


text: DECEMBER 2024

text: DECEMBER 2024

text: DECEMBER 2024

text: The number of reported

text: with minor impact has

text: large incidents were

text: reported.

text: As in previous years,

text: most reported incidents

text: concern qualified

text: certificates (95 %).

text: System failures account

text: for more than half of

text: for the last 8 years of

text: incident reporting.

text: 2023 witnessed an increase in the number of incidents caused by malicious actions affecting, in particular, the number of user hours lost (98 %).

text: (1) One type D incident, which is not analysed here, was reported under eIDAS in 2023. Type D: threat or vulnerability. For instance, the discovery of a cryptographic weakness would be categorised as a type D incident. ( ) 2022:13/27; 2021: 17/27; 2020: 19/27; 2019: 17/27; 2018: 18/27; 2017: 17/27; 2016: 26/27. ( ) Among them, 46 incidents occurred in 9 EU SBs and 21 in SBs from EEA countries. (4) In 2022 it was 0 million. (5) In 2022 it was 34 million and 371 million, respectively.

text: DECEMBER 2024

text: DECEMBER 2024

text: Regulation (EU) No 910/2014

text: of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive

text: https://eur-lex.europa.eu/eli/reg/2014/910/oj (7) https://www.enisa.europa.eu/topics/incident-reporting/cybersecurity-incident-report-and-analysis-system-visual-analysis/visualtool https://ciras.enisa.europa.eu/

text: DECEMBER 2024

text: DECEMBER 2024

text: DECEMBER 2024

text: DECEMBER 2024

text: DECEMBER 2024

text: ( ) ‘Other’ is not defined here. ( ) See ENISA Threat Landscape for Supply Chain Attacks (2021) https://www.enisa.europa.eu/publications/threat-landscape-for-supply-chain-attacks. In 2022 only 8 % of the incidents were denoted as being supply-chain-related (6 % in 2021).

text: DECEMBER 2024

text: Article 3(10)

text: ‘electronic signature’ means data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign. ( )

text: Article 1(25)

text: ‘electronic seal’ means data in electronic form, which is attached to or logically associated with other data in electronic form to ensure the latter’s origin and integrity.

text: DECEMBER 2024

text: Please note that several incidents affected multiple services, hence the numbers in the figure adding up to more than 100 %.

text: DECEMBER 2024

text: DECEMBER 2024

text: DECEMBER 2024

text: DECEMBER 2024

text: ( ) Peak of 100 % in 2016, first year of trust services annual incident reporting.

text: DECEMBER 2024

text: DECEMBER 2024

text: ( ) See Cybersecurity Incident Taxonomy (2018) http://ec.europa.eu/newsroom/dae/document.cfm?doc_id=53646

text: DECEMBER 2024

text: DECEMBER 2024

text: DECEMBER 2024

text: ( ) 2022: 13/27; 2021: 17/27; 2020: 19/27; 2019: 17/27; 2018: 18/27; 2017: 17/27; 2016: 26/27. ( ) Among them, 46 incidents occurred in 9 EU SBs and 21 in SBs from EEA countries. ( ) In 2022 it was 0 million. ( ) In 2022 it was 34 million and 371 million, respectively.

identifier: Annual Report - Trust Services Security Incidents 2023

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Annual Report - Trust Services Security Incidents 2023

serie: rapporter

text: ABOUT ENISA

type: rubrik

text: The European Union Agency for Cybersecurity (ENISA) is working to make Europe cyber secure since 2004. ENISA works with the EU, its Member States, the private sector and Europe’s citizens to develop advice and recommendations on good practice in information security. It assists EU Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU Member States by supporting the development of cross-border communities committed to improving network and information security throughout the EU.

type: stycke

text: More information about ENISA and its work can be found at www.enisa.europa.eu

text: CONTACT

text: For content queries about this report, please email incidentreporting@enisa.europa.eu For media enquiries about this paper, please email press@enisa.europa.eu

text: AUTHOR

text: Marie-Laure Lulé, ENISA

text: ACKNOWLEDGEMENTS

text: We are grateful for the review and input received from ENISA European Competent Authorities for Trust Services. ECATS Expert Group comprises experts from 30 national supervisory bodies in the EU Member States, EFTA, EEA and EU candidate countries. The group is currently chaired by a representative of RTR Austria.

text: LEGAL NOTICE

text: This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the

text: Regulation (EU) No 2019/881

text: ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.

text: Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication.

text: Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. ENISA maintains its intellectual property rights in relation to this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2024 This publication is licenced under CC-BY 4.0 “Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that appropriate credit is given and any changes are indicated”.. TP-01-24-007-EN-N, ISBN: 978-92-9204-684-2, DOI: 10.2824/9574029

text: ANNUAL REPORT - TRUST SERVICES SECURITY INCIDENTS 2023

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 5

text: 1.1 SCOPE 5

text: 1.2 EIDAS REGULATION 5

text: 1.3 DISCLAIMER 5

text: 1.4 STRUCTURE 5

text: 2. INCIDENT REPORTING FRAMEWORK 6

text: 2.1 OVERVIEW OF INCIDENT REPORTING PROCESS 6

text: 2.2 INCIDENT REPORTING TOOL 7

text: 2.3 ANONYMISED EXAMPLES OF SECURITY INCIDENTS 8

text: 3. INCIDENT ANALYSIS 10

text: 3.1 ROOT CAUSE CATEGORIES 10

text: 3.2 DETAILED CAUSES 11

text: 3.3 TYPES OF TRUST SERVICES AFFECTED 12

text: 3.4 QUALIFIED SERVICES VERSUS NON-QUALIFIED SERVICES 16

text: 4. MULTIANNUAL TRENDS 2016–2023 17

text: 4.1 MULTIANNUAL TREND IN ROOT CAUSE CATEGORIES 17

text: 4.2 MULTIANNUAL TREND IN SEVERITY OF IMPACT 19

text: 4.3 MULTIANNUAL TREND IN IMPACT ON SERVICES 20

text: 5. CONCLUSIONS 22 ANNUAL REPORT - TRUST SERVICES SECURITY INCIDENTS 2023 EXECUTIVE SUMMARY Every year national supervisory bodies must send annual summary reports about the notified breaches to ENISA and the Commission.

text: ENISA’s 2023 report on trust services security incidents provides the seventh round of security

text: Highlights 2023

text: incident reporting for the EU’s trust services sector, analysing root causes, statistics and trends.

text: It is an aggregated overview of the reported breaches for 2023 as conveyed to ENISA and the

text: Commission by 27 EU Member States and 3 EEA countries. incidents increased by

text: In 2023, a total of 63 incidents were reported and analysed ( ). The number of incidents Key findings from the 2023 incident reports are summarised in the following increased and five very list of points.

text: • Two thirds of EU supervisory bodies (SBs) – 18 out of 27 – sent their respective

text: reports with 0 incidents reported ( ).

text: • Reported incidents increased by 80 % to a total of 63 incidents, compared with 35

text: in 2022 ( ).

text: • The number of incidents caused by malicious actions – 9 – has increased since

text: 2022 – 5 –, reaching the same level as in 2021. However, with 14 % of the total, it

text: remains a constant percentage since 2022 for this root cause.

text: • The overall impact of the incidents amounted to 3 184 million user hours lost, incidents and have been

text: compared with 405 million in 2022. 3 140 million hours were lost due to malicious the dominant root cause

text: actions, amounting to 98 % of the total ( ). One million hours were lost due to

text: system failures and 43 million hours due to human errors ( ).

text: • In terms of impact, in all four categories – no impact, minor, large, very large – the number of incidents almost doubled:

text: 1. INTRODUCTION

text: 1.1 SCOPE

text: Under Article 19 of the eIDAS regulation ( ), trust service providers (TSPs) in the EU have to notify their national supervisory bodies of any security incidents. The supervisory bodies send summaries of these incident reports to the European Union Agency for Cybersecurity (ENISA) on an annual basis. Subsequently, ENISA publishes an aggregated overview of the reported security incidents.

text: ENISA publishes detailed statistics about trust services security incidents in an online visual tool, ENISA’s cybersecurity incident reporting and analysis system (CIRAS) ( ). This tool allows for a custom analysis of trends and patterns and supports the quantitative and qualitative analysis of the data collected.

text: This document gives an aggregate overview of the security incident reports submitted by the supervisory bodies during 2023. This annual report marks the seventh round of security incident reporting in the EU’s trust services sector, covering security incidents that occurred in 2023.

text: 1.2 EIDAS REGULATION

text: The EU Regulation 910/2014 (eIDAS) sets rules for electronic identity schemes and trust services in Europe, national electronic identification schemes, cross-border interoperability and recognition.

text: Article 19

text: sets the obligation for qualified and non-qualified trust service providers (TSPs) to report any breach of security or loss of integrity that has a significant impact on the trust service provided or on the personal data maintained therein.

text: The eIDAS regulation aims to:

text: • ensure that electronic signatures can have the same legal standing as traditional signatures; • remove barriers to electronic commerce and all types of electronic transactions in the EU, with a view to building a European internal market for trust services • by ensuring that they will work across borders and have the same legal status as their traditional paperbased equivalents.

text: 1.3 DISCLAIMER

text: As per

text: Article 19

text: , this document only contains aggregated and anonymised information about incidents and does not include details about individual countries or individual TSPs.

text: 1.4 STRUCTURE

text: This document is structured as follows:

text: - Section 2 briefly reviews the processes, incl. CIRAS tool and describes anonymised examples of reported incidents; - Section 3 presents the categories of root causes, the detailed causes and the affected services; - Section 4 describes the multiannual trends in incidents from 2016-2023; - Section 5 draws conclusions and observations based on the available datasets.

text: ANNUAL REPORT - TRUST SERVICES SECURITY INCIDENTS 2023 DECEMBER 2024

text: 2. INCIDENT REPORTING FRAMEWORK

text: In this section, we give an overview of the formats and procedures for the reporting of incidents (breaches) under Article 19 of the eIDAS regulation. eIDAS

text: Article 19

text: requires TSPs 2.1 OVERVIEW OF INCIDENT REPORTING PROCESS

text: The mandatory security breach notification process has three steps, in the EU to: as displayed in Figure A. 1) assess risks; 1. TSPs notify their national supervisory body about security breaches that have significant impact. 2) take 2. National supervisory bodies inform each other and ENISA if there is a appropriate cross-border impact. security 3. National supervisory bodies send annual summary reports about the measures to reported breaches to ENISA and the Commission. mitigate security breaches; and Figure A. Security breach notification process 3) report breaches to national supervisory bodies.

text: ANNUAL REPORT - TRUST SERVICES SECURITY INCIDENTS 2023 2.2 INCIDENT REPORTING TOOL

text: Experts from national authorities have access to CIRAS, ENISA’s incident reporting tool, where they can upload incident reports and search for and study specific incidents.

text: ENISA reporting template starts with a type selector and contains three parts.

text: 1. Impact of the incident: which trust services are impacted and by how much? 2. Nature of the incident: what caused the incident? 3. Details about the incident: short description, types of services and assets, severity level, etc.

text: Figure B. Incident reporting tool

text: ▪ Type A: service outage (e.g. continuity, availability). For example, an outage caused by a cable being cut by mistake by the operator of an excavation machine used for building a new road would be categorised as a type A incident.

text: ▪ Type B: other impact on service (e.g. confidentiality, authenticity, integrity). For example, a popular collaboration tool has not encrypted the content of the media channels which are established when a session is started between the endpoints participating in the shared session. This leads to the interception of the media (voice, pictures, video, files, etc.) through a man-in-the-middle attack. This incident would be categorised as a type B incident.

text: ▪ Type C: impact on other systems (e.g. ransomware in an office network, no impact on the service). For example, malware is detected on several workstations and servers of the office network of a telecom provider. This incident would be categorised as a type C incident.

text: ▪ Type D: threat or vulnerability (e.g. discovery of crypto flaw). For instance, the discovery of a cryptographic weakness would be categorised as a type D incident.

text: ▪ Type E: impact on redundancy (e.g. failover or backup system). For example, the breaking of one of two redundant submarine cables would be categorised as a type E incident. ▪ Type F: near-miss incident (e.g. activation of security measures). For instance, a malicious attempt that ends up in the honeypot network of a telecom provider would be categorised as a type F incident. Depending on the type selected, some fields in the template are deactivated. For example, in the case of a Type A incident, the fields ‘threat severity factors’ and ‘severity of threat’ are not active.

text: 2.3 ANONYMISED EXAMPLES OF SECURITY INCIDENTS

text: In this paragraph, some kinds of incidents that are reported are presented by providing detailed and anonymised examples.

text: Incident example 1

text: Incident type A – core service outage Service affected e-signature, e-seal, e-timestamp Root cause System failure Technical causes Overload Generation (signatures, seals and timestamps) Certificate management (registration and creation of certificates, suspension,

text: Assets affected

text: revocation) Validation Unavailability of the e-signature/e-seal/e-timestamp services due to a

text: Comment

text: backend system overload.

text: Incident example 2

text: Incident type A – core service outage Service affected e-signature, e-seal Root cause Malicious actions Technical causes Ransomware Certification authority (CA) platform; generation and validation of

text: Assets affected

text: signatures/seals platform; network platform Provider suffered a ransomware attack, but no systems supporting trust services were affected. As a precaution, all systems were disconnected from

text: Comment

text: the network. No certificates had to be revoked.

text: ANNUAL REPORT - TRUST SERVICES SECURITY INCIDENTS 2023 Incident example 3

text: Incident type A – core service outage Service affected e-signature, e-timestamp Root cause System failure Technical causes Software bug; configuration issue Assets affected Generation and validation of signatures/seals platform; software An issue with the configuration of a supporting system led to the loss

text: Comment

text: of availability of the e-signature and e-timestamp services.

text: Incident example 4

text: Incident type B – other impact on core service Service affected e-signature Root cause Malicious actions Technical causes Malware and viruses Assets affected Generation and validation of signatures/seals platform The incident concerns the leak of credentials for qualified signatures.

text: Comment

text: The affected qualified certificates were revoked and users informed.

text: Incident example 5

text: Incident type D – active threat or vulnerability Service affected Generation of signatures/seals platform Root cause Human errors Faulty software change/update

text: Technical causes

text: malware and viruses Assets affected Software Potential malware in qualified signature creation device middleware,

text: Comment

text: which was removed immediately after notification.

text: 3. INCIDENT ANALYSIS

text: The 2023 annual summary reporting, by the 27 EU Member States and 3 EEA countries participating in this process, included in total 63 security incidents. This is the seventh round of annual summary reporting since eIDAS came into force on 1 July 2016.

text: Figure 1. Number of reported incidents from 2016–2023

text: In 2023, the number of incidents increased by 80 %, despite the 25 % decrease in reported incidents in 2022. However, this 2023 data is aligning with the trend observed over the period analysed.

text: 3.1 ROOT CAUSE CATEGORIES

text: Figure 2 shows the distribution of the incidents according to their underlying root cause. The overall impact of the incidents amounted to 3 184 million user hours lost, one million hours of which reflected system failures, 43 million hours human errors and 3 140 million hours malicious actions.

text: Incidents are divided into four categories of root causes.

text: • System failures continue to be the dominant root cause, accounting for more than half of total trust services incidents reported (63 %, 40 incidents). Typically, system failures are due to either hardware failures or software bugs. • With 14 incidents, 22 % of incidents were categorised as being caused by human errors. • With nine incidents, 14 % of the incidents were flagged as malicious actions. • Natural phenomena did not account for any of the reported incidents.

text: Figure 2. Root causes of TSP security incidents – 2023

text: We also keep track of third-party failures, i.e. when the incident really originated from a third party, with a view to assessing the impact on the supplier or the provider. For 2023, 19 incidents out of 63 were flagged as third-party failures (33 %). Out of those reported in 2023:

text: - 15 out of 19 were categorised as system failures (40); - 2 out of 19 were categorised as being caused by human errors (14); and - 2 out of 19 were categorised as malicious actions (9).

text: 3.2 DETAILED CAUSES

text: It is important to note that an incident is often not only triggered by one cause ( ) but by multiple detailed causes (i.e. a chain of events).

text: The two most common detailed causes of incidents in 2023 were faulty software changes/updates (20 %) and software bugs (17 %). Flaws in the organisation’s policy or procedures and faulty hardware changes/updates each account for around 15 % of the incidents, and hardware failures for 14 %. Note that the category ‘Other’ with 15 % is not defined in the dataset.

text: Moreover, supply-chain causes ( ), which were first introduced 2 years ago, accounted for 6 % of reported incidents in 2023 (8 % in 2022). A percentage equivalent was found for the faulty hardware change/update and distributed denial-of-service (DDoS) attacks.

text: The full breakdown of detailed causes for reported incidents can be seen in Figure 3.

text: Figure 3. Detailed causes of trust services security incidents – 2023

text: 3.3 TYPES OF TRUST SERVICES AFFECTED

text: The most commonly affected services are e-signatures, e-seals and e-stamps.

text: Most of the reported incidents (95 %) had an impact on electronic signatures ( ), as can be seen in Figure 4, compared with 82 % in 2022. Among them, 65 % were related to system failures, 22 % to human errors and 13 % to malicious actions.

text: Interestingly, 26 % of incidents reported affected electronic seals ( ), compared with 14 % in 2022. Among them, 76 % were related to system failures, 12 % to human errors and 12 % to malicious actions.

text: Electronic timestamps make up 12 % of the total.

text: Figure 4. Impact of incidents on trust services – 2023

text: In Figure 5, for each incident we kept track of the underlying subservices affected in 2023, i.e. certificate management, validation and generation of signatures/seals/timestamps.

text: - Incidents most frequently affected certificate management: 49 of 63, representing 77.77 % (71.43 % in 2022 and 63.04 % in 2021). - Incidents affecting the generation of signatures/seals/timestamps continued to decrease, reaching 39.68 % (42.86 % in 2022). - Incidents affecting the validation subservice accounted for 14.28 % of the total in 2023 (17.14 % in 2022 and 15.22 % in 2021).

text: Once again, impact on multiple subservices may be reported for incidents, hence the numbers in Figure 5 adding up to more than 100 %.

text: Figure 5. Impact of incidents on subservices – 2023

text: Finally, we also keep track of the underlying assets affected by incidents.

text: - The CA platform (43 %, compared with 33 % in 2022). - The generation and validation of the signatures/seals platform (29 %, compared with 45 % in 2022). - The network platform (24 %, compared with 11 % in 2022). - The registration authority’s platform (21 %, a constant). - Software assets represented 8 % of affected assets over the reported period.

text: The dispersion of affected assets calls for a comprehensive approach when it comes to the security of trust services, taking into account assets from across the entire life cycle and supply chain. See the impact on technical assets in

text: Figure 6.

text: Figure 6. Technical assets affected – TSP security incidents 2023

text: By looking deeper into the affected technical assets, one can ascertain noteworthy differences between the corresponding technical causes, as detailed in Figure 7. In the case of the platform for the generation and validation of signatures/seals, 38 % of the incidents report that flaws in policies and procedures were the main root cause in 2023, compared with 25 % in 2022. Software bugs account for 22 %. Figure 7a - generation and validation of signatures/seals

text: In the case of the CA’s platform, the three main root causes are flaws in processes/procedures (25 %), software bugs (18 %) an

text: d faulty software changes/updates (18 %). Figure 7b – CA’s platform

text: The registration platform incidents have a lower percentage (15 %) of flaws in policies and procedures as their root cause, but higher percentages of faulty software changes/updates (23 %) and supply-chain and software bugs related incidents (15 %). Note that the column ‘Other’ with 23 % is not defined in the dataset. Figure 7c – Registration’s platform

text: The network platform has 20 % of DDoS attacks as a root cause, followed by 13 % of supply-chain attacks.

text: The category ‘Other’ with 26 % in this table is not defined in the dataset.

text: Figure 7d. Network platform

text: This comprehensive breakdown is extremely important to understand where emphasis should be prioritised when it comes to targeted security controls in the various technical assets of TSPs.

text: 3.4 QUALIFIED SERVICES VERSUS NON-QUALIFIED SERVICES

text: This year nearly 84 % of total trust services security incidents had an impact on qualified services (i.e. qualified signature certificate creation, qualified seal certificate creation, etc.) with 85 qualified services and 6 non-qualified services. Again, it is important to note that one incident report could involve multiple trust services, which explains why the total number of incidents in Figure 8 adds up to more than 63 (i.e. the total number of incidents reported in 2023).

text: Figure 8. Reported incidents affecting qualified v non-qualified services – 2023

text: 100 80 60 40 20 0 1 2 3

text: 85 6 2

text: Note that, in most cases, the TSP reporting an incident also offers qualified services and that the impact on nonqualified services is usually reported as part of an incident report for a qualified trust service (hence the numbers adding up to more than 100 %). This suggests that there is a gap in the reporting and that, while

text: Article 19

text: is also concerned with non-qualified services, only the TSPs offering qualified trust services are reporting incidents, and mostly do so for incidents that impact qualified services. Moreover, we need to underline a decrease in the number of non-qualified service incidents being reported compared with 2022 (7), which indicates the need to promote the importance of incident reporting to the respective providers.

text: 4. MULTIANNUAL TRENDS 2016–2023

text: ENISA has been collecting and aggregating trust services incident reports since 2016. In this section, we look at multiannual trends over the last 8 years, covering 2016–2023. The dataset contains a total of 244 reported incidents.

text: 4.1 MULTIANNUAL TREND IN ROOT CAUSE CATEGORIES

text: Root-cause categories, i.e. system failures, human errors, malicious actions and natural phenomena, are analysed over the period of reference ( ). From 2016–2023 system failures represented 57 % of all reported incidents, human errors represented 27 % of all reported incidents, 15 % involved malicious actions and 2 % natural phenomena, as displayed in Figure 9. Figure 9. Nature of reported incidents – trust services security incidents in the EU (reported from 2016–2023)

text: Over the period of reference, out of 244 incidents reported: - system failures accounted for 139 of all reported incidents, - human errors accounted for 65 of all reported incidents, - 37 involved malicious actions, and - 3 involved natural phenomena.

text: Percentage trends of related incidents over the last 8 years are displayed in Figure 10, arranged by category.

text: Figure 10. Root-cause categories – trust services security incidents in the EU (reported from 2016–2023)

text: Over the last few years of trust services security incident reporting, the most common root cause has been system failures, with a total of 139 reported incidents. The percentage of system-failure-related incidents over the last 8 years has varied as follows: 100 % in 2016, 71.4 % in 2017, 44.4 % in 2018, 62.5 % in 2019, 52.8 % in 2020, 46.7 % in 2021, 57.1 % in 2022 and 63.5 % in 2023, representing an average of 57 % over the period analysed.

text: Moreover, incidents concerning human errors have remained constant since 2020 with an average of circa 14 incidents per year. In terms of percentage of total incidents, this data has been steadily decreasing over the last few years, from 38.9 % in 2020 to 31.1 % in 2021, 28.6 % in 2022 and 22.2 % in 2023.

text: In the trust services sector, natural phenomena are not a common root cause. From 2016–2023 only three incidents were reported, accounting for 1 % of the total. No such incidents were reported in 2022 or 2023.

text: Malicious actions vary across the years, with the peak of 38.9 % observed during 2018 and a value as low as 5.6 % recorded in 2020. In 2023, malicious actions were the root cause for 14.3 % of the reported incidents with nine incidents, likewise in 2022 with five incidents, and for 20 % of reported incidents in 2021 with nine incidents.

text: For the 37 incidents reported under the malicious actions category, the most common technical causes over the years are given in Figure 11.

text: Figure 11. Detailed technical causes – trust services security incidents in the EU (reported from 2016–2023)

text: It is interesting to contrast these findings with the latest version of the ENISA threat landscape and the identified prime threats (threats against data, malware, threats against availability, non-malicious threats, etc.).

text: 4.2 MULTIANNUAL TREND IN SEVERITY OF IMPACT

text: In the multiannual trend concerning the severity of impact, the EU cybersecurity incident taxonomy ( ) is again followed, where the severity of the impact has the following values: no impact, minor, large and very large impact. Over time, TSPs are reporting more incidents regardless of their severity.

text: The number of incidents with no impact was 5 in 2023.

text: It is interesting to see that there is a mostly linear increase in minor incidents (in green) over the course of the last years from 2 incidents in 2018, to 19 in 2019, 26 in 2020 and 30 in 2021, with a drop to 19 in 2022 and a rise to 35 in 2023.

text: While comparing the statistics for severity since 2016, it is quite clear that large impact incidents (in yellow) have continued to increase (by one third) in frequency, reaching 18 incidents this year, despite the drop observed in 2020.

text: With respect to the five very large impact incidents reported this year, the trend since 2021 shows an increase over time.

text: In terms of impact, in all four categories, the number of incidents almost doubled compared with 2022. However, looking at the trends, the increase has followed a steady path since 2018, as detailed in Figure 12. Figure 12. Severity of impact – trust services security incidents in the EU (reported from 2016–2023)

text: 5 2 4.3 MULTIANNUAL TREND IN IMPACT ON SERVICES

text: In this section, the impact per service from 2016–2023 for reported incidents for trust services is detailed in Figure 13.

text: It is evident that the majority of reported incidents relate to electronic signatures, with numbers ranging consistently between 65 % and 95 % since 2017, reaching 95 % in 2023 to give an average of 85.5 % over the period analysed. This may be attributed to their widespread deployment and uptake in comparison to electronic seals and timestamping services. For these categories, if we look back at the past years of reporting (2016–2023), we see a similar pattern: 23 % affected electronic seals and 14 % affected timestamping services. Web certificates and electronic delivery services consistently have low values. The latter two categories require further attention to explore the reason for the low number of reported incidents, to investigate whether this is due to a reduced usage of the services, better security provisions or a lack of reporting.

text: Figure 13. Impact on services – trust services security incidents in the EU (reported from 2016–2023)

text: 5. CONCLUSIONS

text: The key takeaways from the 2023 incident reports are as follows.

text: • Two thirds of EU SBs – 18 out of 27 – sent their respective reports with 0 incidents reported ( ). • Reported incidents increased by 80 % to a total of 63 incidents, compared with 35 in 2022 ( ). • The number of incidents (9) caused by malicious actions has increased compared with 2022 (5) reaching the same level as in 2021. However, with 14 % of the total, it remains a constant percentage since 2022 for this root cause. • The overall impact of the incidents amounted to 3 184 million user hours lost, compared with 405 million in 2022, among which 3 140 million hours (98 %) were lost due to malicious actions ( ). One million hours were lost due to system failures and 43 million hours were lost due to human errors ( ). • In terms of impact, in all four categories the number of incidents almost doubled: - in 2023, 5 incidents with no impact were reported, 35 with minor impact, 18 large incidents and 5 very large incidents; - the number of incidents with minor impact has almost doubled compared with 2022, but remains in line with data from previous years; - the number of large and very large incidents has continued to increase. • Third-party failures continue to be monitored, with a view to assessing the impact on suppliers and providers. For 2023, 19 incidents out of 63 were flagged as third-party failures (33 %). • Qualified trust services versus non-qualified trust services – in 2023, 84 % of total incidents had an impact on qualified trust services.

text: -N -EN -007 -24 -01 TP

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: ISBN 978-92-9204-684-2 doi: 10.2824/9574029


text: JUNE 2025

text: JUNE 2025

text: JUNE 2025

text: JUNE 2025

text: Regulation (EU) No 910/2014

text: of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive

text: : https://eur-lex.europa.eu/legalcontent/EN/TXT/HTML/?uri=CELEX:32014R0910 ( ) Please, take into consideration that we have 6 member states less reporting at the time of writing of the report than what was on 2023

text: JUNE 2025 • In terms of impact, large incidents continue to raise 5

text: JUNE 2025

text: ( ) For more information https://www.enisa.europa.eu/topics/incident-reporting/cybersecurity-incident-report-and-analysis-systemvisual-analysis/visual-tool; website of the tool can be found here: https://ciras.enisa.europa.eu/

text: JUNE 2025

text: JUNE 2025

text: JUNE 2025

text: JUNE 2025

text: JUNE 2025

text: JUNE 2025

text: JUNE 2025

text: JUNE 2025

text: JUNE 2025

text: JUNE 2025

text: JUNE 2025

text: JUNE 2025

text: ( ) ‘Other’ is not defined here. 18

text: JUNE 2025

text: Article 3(10)

text: ‘electronic signature’ means data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign. 19

text: JUNE 2025

text: ( ) Please note that several incidents affected multiple services, hence the numbers in the figure adding up to more than 100% 20

text: JUNE 2025

text: JUNE 2025

text: JUNE 2025

text: ( ) See Cybersecurity Incident Taxonomy (2018) http://ec.europa.eu/newsroom/dae/document.cfm?doc_id=53646 8 ( ) Here we would like to mention that this might be due to the missing reports from 6 member states at the time of writing

text: JUNE 2025

text: JUNE 2025 Figure 18. Impact on services – trust services security incidents in the EU (reported from 2017–2024) 25

text: JUNE 2025

identifier: Annual Report - Trust Services Security Incidents 2024

title: Annual Report - Trust Services Security Incidents 2024

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity (ENISA) is working to make Europe cyber secure since 2004. ENISA works with the EU, its Member States, the private sector and Europe’s citizens to develop advice and recommendations on good practice in information security. It assists EU Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU Member States by supporting the development of cross-border communities committed to improving network and information security throughout the EU.

text: More information about ENISA and its work can be found at www.enisa.europa.eu

text: CONTACT

text: For content queries about this report, please email incidentreporting@enisa.europa.eu For media enquiries about this paper, please email press@enisa.europa.eu

text: AUTHOR

text: Rossen Naydenov, ENISA

text: Nuno Rodrigues Carvalho, ENISA

text: Edgars Taurins, ENISA

text: ACKNOWLEDGEMENTS

text: We are grateful for the review and input received from ENISA European Competent Authorities for Trust Services. ECATS Expert Group comprises experts from 30 national supervisory bodies in the EU Member States, EFTA, EEA and EU candidate countries. The group is currently chaired by a representative of RTR Austria.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or ENISA bodies unless adopted pursuant to the

text: Regulation (EU) 2019/881

text: . This publication does not necessarily represent the state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2025 Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/).

text: ANNUAL REPORT TRUST SERVICES SECURITY INCIDENTS 2024

text: This means that reuse is allowed, provided appropriate credit is given and any changes are indicated. For any use or reproduction of elements that are not owned by the European Union Agency for Cybersecurity, permission may need to be sought directly from the respective rightsholders.

text: ISBN 978-92-9204-707-8 DOI: 10.2824/2144753, ISSN: 2599-9435

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 6

text: 1.1 SCOPE 6

text: 1.2 EIDAS REGULATION 6

text: 1.3 DISCLAIMER 6

text: 1.4 STRUCTURE 6

text: 2. INCIDENT REPORTING FRAMEWORK 7

text: 2.1 OVERVIEW OF INCIDENT REPORTING PROCESS 7

text: 2.2 INCIDENT REPORTING TOOL 8

text: 2.3 ANONYMISED EXAMPLES OF SECURITY INCIDENTS 9

text: 3. INCIDENT ANALYSIS 11

text: 3.1 ROOT CAUSE CATEGORIES 11

text: 3.1.1 System Failures 13 3.1.2 Human errors 15 3.1.3 Malicious actions 17

text: 3.2 TECHNICAL CAUSES 18

text: 3.3 SERVICES AFFECTED 19

text: 3.4 ASSETS AFFECTED 20

text: 3.5 QUALIFIED SERVICES VERSUS NON-QUALIFIED SERVICES 21

text: 4. MULTIANNUAL TRENDS 2017–2024 22

text: 4.1 ROOT CAUSE TRENDS 22

text: 4.2 IMPACT SEVERITY TRENDS 23

text: 4.3 IMPACT ON SERVICES TRENDS 24

text: 5. CONCLUSIONS 26

text: ANNUAL REPORT TRUST SERVICES SECURITY INCIDENTS 2024 EXECUTIVE SUMMARY

text: Every year national supervisory bodies must send annual summary reports about the notified breaches to ENISA and the Commission according to art 19 of the eIDAS regulation.

text: This is the eighth round of reporting produced by ENISA, for the EU’s trust services sector, analysing root causes, statistics and trends. It is an aggregated overview of the reported breaches for 2024 as reported to ENISA by 21 EU Member States and 3 EFTA countries.

text: In 2024, a total of 44 incidents were reported by these countries. Highlights 2024

text: System failures

text: Key findings from the 2024 incident reports are summarised in the following list of points.

text: account for more than

text: • Half of the EU supervisory bodies (SBs) – 12 out of 24 – sent their respective

text: half of incidents and

text: reports with 0 incidents reported.

text: have been the dominant

text: • Reported incidents decreased to 44, compared to 63 in 2023. However, it should

text: root cause for the last

text: be noted that in 2023 there were 6 more MS reporting incidents.

text: 8 years of incident

text: • The distribution of incidents remains similar percentage-wise compared to 2023

text: reporting.

text: with system fail taking the major cut at 63% (64% in 2023), human error 23% (same for 2023) and malicious actions 14% (same for 2023). • The overall impact of the incidents amounted to 618 million user hours lost which is a decrease of 5 times compared to 3 184 million user hours lost in 2023 . Malicious actions is the • Malicious actions are the most impactful root cause with 571 million user hours most impactful root lost with over 92% of all hours lost, which is a decline compared to 2023 where we cause in terms of user had 98% of all hours lost (3140 million).

text: hours lost with more than 92% of all user hours lost attributed to this root cause.

text: ANNUAL REPORT TRUST SERVICES SECURITY INCIDENTS 2024 ANNUAL REPORT TRUST SERVICES SECURITY INCIDENTS 2024

text: 1. INTRODUCTION

text: 1.1 SCOPE

text: Under Article 19 of the eIDAS regulation, trust service providers (TSPs) in the EU have to notify their national supervisory bodies of any security incidents. The supervisory bodies send summaries of these incident reports to the European Union Agency for Cybersecurity (ENISA) on an annual basis and ENISA publishes an aggregated overview of the reported security incidents.

text: ENISA publishes detailed statistics about trust services security incidents in an online visual tool, ENISA’s cybersecurity incident reporting and analysis system (CIRAS) ( ). This tool allows for a custom analysis of trends and patterns and supports the quantitative and qualitative analysis of the data collected.

text: This report gives an aggregate overview of the incidents submitted to ENISA by the supervisory bodies during 2024.

text: 1.2 EIDAS REGULATION

text: The EU Regulation 910/2014 (eIDAS) sets rules for electronic identity schemes and trust services in Europe, national electronic identification schemes, cross-border interoperability and recognition.

text: Article 19

text: sets the obligation for qualified and non-qualified trust service providers (TSPs) to report any breach of security or loss of integrity that has a significant impact on the trust service provided or on the personal data maintained therein.

text: The eIDAS regulation aims to:

text: • ensure that electronic signatures can have the same legal standing as traditional signatures; • remove barriers to electronic commerce and all types of electronic transactions in the EU, with a view to building a European internal market for trust services; • by ensuring that they will work across borders and have the same legal status as their traditional paperbased equivalents.

text: 1.3 DISCLAIMER

text: As per

text: Article 19

text: , this document only contains aggregated and anonymised information about incidents and does not include details about individual countries or individual TSPs.

text: 1.4 STRUCTURE

text: This document is structured as follows:

text: - Section 2 briefly reviews the processes, incl. CIRAS tool and describes anonymised examples of reported incidents; - Section 3 presents the categories of root causes, the detailed causes and the affected services; - Section 4 describes the multiannual trends in incidents from 2017-2024; - Section 5 draws conclusions and observations based on the available datasets.

text: 2. INCIDENT REPORTING FRAMEWORK

text: In this section, we give an overview of the formats and procedures for the reporting of incidents (breaches) under Article 19 of the eIDAS regulation.

text: eIDAS

text: Article 19

text: requires TSPs in 2.1 OVERVIEW OF INCIDENT REPORTING PROCESS the EU to:

text: The mandatory security breach notification process has three steps, as displayed in Figure A.

text: 1) assess risks; 2) take appropriate

text: 1. TSPs notify their national supervisory body about security breaches that have significant impact. security measures 2. National supervisory bodies inform each other and ENISA if there is a to mitigate security cross-border impact. breaches; and 3. National supervisory bodies send annual summary reports about the

text: 3) report breaches

text: reported breaches to ENISA and the Commission.

text: to national supervisory bodies.

text: Figure A. Security breach notification process

text: ANNUAL REPORT TRUST SERVICES SECURITY INCIDENTS 2024 2.2 INCIDENT REPORTING TOOL

text: Experts from national authorities have access to CIRAS, ENISA’s incident reporting tool, where they can upload incident reports and search for and study specific incidents.

text: ENISA reporting template starts with a type selector and contains three parts.

text: 1. Impact of the incident: which trust services are impacted and by how much? 2. Nature of the incident: what caused the incident? 3. Details about the incident: short description, types of services and assets, severity level, etc.

text: Figure B. Incident reporting tool

text: ▪ Type A: service outage (e.g. continuity, availability). For example, an outage caused by a cable being cut by mistake by the operator of an excavation machine used for building a new road would be categorised as a type A incident.

text: ▪ Type B: other impact on service (e.g. confidentiality, authenticity, integrity). For example, a popular collaboration tool has not encrypted the content of the media channels which are established when a session is started between the endpoints participating in the shared session. This leads to the interception of the media (voice, pictures, video, files, etc.) through a man-in-the-middle attack. This incident would be categorised as a type B incident.

text: ▪ Type C: impact on other systems (e.g. ransomware in an office network, no impact on the service). For example, malware is detected on several workstations and servers of the office network of a telecom provider. This incident would be categorised as a type C incident.

text: ▪ Type D: threat or vulnerability (e.g. discovery of crypto flaw). For instance, the discovery of a cryptographic weakness would be categorised as a type D incident.

text: ▪ Type E: impact on redundancy (e.g. failover or backup system). For example, the breaking of one of two redundant submarine cables would be categorised as a type E incident.

text: ▪ Type F: near-miss incident (e.g. activation of security measures). For instance, a malicious attempt that ends up in the honeypot network of a telecom provider would be categorised as a type F incident.

text: Depending on the type selected, some fields in the template are deactivated. For example, in the case of a Type A incident, the fields ‘threat severity factors’ and ‘severity of threat’ are not active.

text: 2.3 ANONYMISED EXAMPLES OF SECURITY INCIDENTS

text: In this paragraph, some kinds of incidents that are reported are presented by providing detailed and anonymised examples.

text: Incident example 1

text: Incident

text: A – core service outage

text: type Service

text: e-signature, e-seal, e-timestamp

text: affected

text: Root cause System failure

text: Technical

text: Overload

text: causes

text: Generation (signatures, seals and timestamps) Assets Certificate management (registration and creation of certificates, suspension, affected revocation) Validation Unavailability of the e-signature/e-seal/e-timestamp services due to a

text: Comment

text: backend system overload.

text: Incident example 2

text: Incident

text: A – core service outage

text: type Service

text: e-signature, e-seal

text: affected

text: Root cause Malicious actions

text: Technical

text: Ransomware

text: causes

text: Assets Certification authority (CA) platform; generation and validation of affected signatures/seals platform; network platform Provider suffered a ransomware attack, but no systems supporting trust services were affected.

text: Comment

text: As a precaution, all systems were disconnected from the network. No certificates had to be revoked.

text: Incident example 3

text: Incident type A – core service outage Service affected e-signature, e-timestamp

text: Root cause System failure Technical causes Software bug; configuration issue Assets affected Generation and validation of signatures/seals platform; software An issue with the configuration of a supporting system led to the loss

text: Comment

text: of availability of the e-signature and e-timestamp services.

text: Incident example 4

text: Incident type B – other impact on core service Service affected e-signature Root cause Malicious actions Technical causes Malware and viruses Assets affected Generation and validation of signatures/seals platform The incident concerns the leak of credentials for qualified signatures.

text: Comment

text: The affected qualified certificates were revoked and users informed.

text: Incident example 5

text: Incident type D – active threat or vulnerability Service affected Generation of signatures/seals platform Root cause Human errors Faulty software change/update

text: Technical causes

text: malware and viruses Assets affected Software Potential malware in qualified signature creation device middleware,

text: Comment

text: which was removed immediately after notification.

text: 3. INCIDENT ANALYSIS

text: The 2024 annual summary reporting, by the 21 EU Member States and 3 EEA countries participating in this process, included in total 44 security incidents.

text: Figure 1. Number of reported incidents from 2017–2024

text: 3.1 ROOT CAUSE CATEGORIES

text: Figure 2 shows the distribution of the incidents according to their underlying root cause. The overall impact of the incidents amounted to 618 million user hours lost, 42 million hours of which were for system failures, 4 million hours human errors and 571 million hours malicious actions. In comparison for 2023 we had 3184 million user hours lost, with system failures having 1 million, human errors 43 million and malicious actions with 3140 million.

text: Incidents are divided into four categories of root causes.

text: • System failures continue to be the dominant root cause in 2024, accounting for 64% out of 28 incidents compared to 63% with 40 incidents in 2023. Typically, system failures are due to either hardware failures or software bugs. • Human errors accounted for 23% with 10 incidents, which is similar in percentage for 2023 with 22% albeit with more incidents - 14. • Malicious actions with 6 incidents got a share of 14%, which is the same percentage in 2023, with 9 incidents. • Natural phenomena did not account for any of the reported incidents, which is a trend for the last three years.

text: Figure 2. Root causes of TSP security incidents – 2024 We also keep track of third-party failures, i.e. when the incident originated from a third party, with a view to assessing the impact on the supplier or the provider. In 2024, out of 44 reported incidents 7 are marked as third-party failures, compared to 19 incidents out of 63 were flagged as third-party failures for 2023. Out of those reported in 2024: - 6 were categorised as system failures and - 1 were categorised as malicious actions.

text: ANNUAL REPORT TRUST SERVICES SECURITY INCIDENTS 2024 3.1.1 System Failures

text: System failures account for 28 of all 44 incidents resulting in 64% share for 2024. The most impacted services by system failures are the eSignatures with 85% of all system failures. eTimestamp come second with 17% and webCertificates with 14%.

text: Figure 3. System failures impact on services – 2024

text: The top three technical causes for system failures are hardware failure with 32%, Software bugs with 28% and policy procedure flaw with 14%. The top two causes are similar to 2023 the difference being that policy procedure was last in the score with 5% while faulty software changes were third with 25%.

text: Figure 4. Technical causes for System failures– 2024 The top three technical assets affected by the system failures in 2024 are Certification authority platform (32%), registration authority (32%) and generation and validation of signatures/seals platform with 29%. The difference with 2023 is in the changes in second and third place, where we had generation and validation of signatures/seals platform second with 30% and network platform third with 25%.

text: Figure 5. Technical assets affected by System failures– 2024

text: ANNUAL REPORT TRUST SERVICES SECURITY INCIDENTS 2024 3.1.2 Human errors

text: The human errors incidents are 10 in total, representing a 23% share of all incidents in 2024.

text: The human errors have a limited impact in terms of services affected for 2024, compared to system failures. Only three were affected with eSignature being the top with 80%, which is similar as in 2023 where we had 92%. Second and third are the eTimestamp and webCertificate with same results at 10%. For comparison in 2023 we also had eSeal affected with 14%, which made it the second most affected in that year.

text: Figure 6. Human errors impact on services – 2024

text: The top three technical causes for human errors in 2024 were policy/procedure flaw with 60%, similar to 2023 where this cause was with 42%. Second comes faulty software change/update with 30% and last are software bugs with 10%. For comparison in 2023 we also had tampering of personal data standing in last place with 7%.

text: Figure 7. Technical causes for human errors– 2024

text: The top three technical assets affected by human errors in 2024 were the generation and validation of signatures/seals platform with 50%, second comes the certification authority with 40% and last are the time stamping and the validation authority with both having 10%. For comparison in 2023 we had certification authority with 29% being top cause, while the rest generation and validation of signatures/seals platform, registration authority and software were all with 21%.

text: Figure 8. Technical assets affected by Human errors– 2024

text: ANNUAL REPORT TRUST SERVICES SECURITY INCIDENTS 2024 3.1.3 Malicious actions

text: Malicious actions have 14% of the share with 6 incidents for 2024. The malicious actions have a very targeted service for 2024 and this is the eSginature service, with all the incidents reported on this particular service.

text: The top three technical causes for malicious actions in 2024 are tampering of personal data with 50%, second comes malware and viruses with 33% and last are theft or loss of data and theft or loss of equipment both with 16%.

text: Figure 9. Technical causes for malicious actions – 2024

text: The top three technical assets affected by the malicious actions in 2024 were Archive with 33%, generation and validation of signatures/seals platform with 33% and certification authority and network platform at 17%. In comparison for 2023 the CA authority was top asset affected with 44%, second comes generation and validation of signatures/seals platform with 33% and third was registration authority with 22%.

text: Figure 10. Technical assets affected by malicious actions – 2024

text: 3.2 TECHNICAL CAUSES

text: It is important to note that an incident is often not only triggered by one cause ( ) but by multiple detailed causes (i.e. a chain of events). The top detailed cause of incidents in 2024 was the policy/procedure flaw, with 10 incidents accounting for 22% of all incidents. This is an increase compared to 2023 where policy procedure flaw was third technical cause with 13 incidents at 15%. Software bugs come second overall with 20% and 9 incidents, which is an increase in the share from 2023 where it was 17% with 11 incidents. Hardware failure comes in third place with 20% share and 9 incidents, which is an increase in the share from 14% in 2023, with the same number of incidents. Faulty software changes/updates with 13% and 6 incidents are forth, which is a big change compared to 2023, where it was the top cause with 20% and 13 incidents. The full breakdown of detailed causes for reported incidents can be seen in Figure 11.

text: Figure 11. Detailed causes of trust services security incidents – 2024

text: 3.3 SERVICES AFFECTED

text: The most affected services in 2024 are eSignature, eTimestamp and webCertificate. Most of the reported incidents (86%) had an impact on electronic signatures ( ), as can be seen in Figure 12, compared to 95% having an impact on electronic signatures in 2023. eTimestamps come distant second with just 13% representing 6 incidents, which is similar to 12% and 8 incidents in 2023. The third most impacted services was webCertifcate with 11% and 5 incidents, which is an increase from 2023 where it had 4% and 3 incidents. eSeal had the biggest decline with 6% and 3 incidents, while in 2023 there were 26% and 7 incidents.

text: Figure 12. Impact of incidents on trust services – 2024

text: 3.4 ASSETS AFFECTED

text: Finally, we also keep track of the underlying assets affected by incidents, which can be seen in Figure 13. The top affected assets are the generation and validation of signtures/seals platform with 34% and 15 incidents, which is an increase in percentage compared to 2023 with 28% with a bigger number of incidents – 18. The second most affected asset in 2024 is the certification authority platform with 32% and 14 incidents which is a decrease compared to 2023 where it was top cause with 43% and 27 incidents. The registration authority platform is the third most impacted asset with 23% and 10 incidents which is similar to 2023 where we had 21% and 13 incidents. Network platform is forth with 18% and 8 incidents, which is a decrease in share compared to 2023 with 24% and double the incidents to 15.

text: Figure 13. Technical assets affected – TSP security incidents 2024

text: 3.5 QUALIFIED SERVICES VERSUS NON-QUALIFIED SERVICES

text: This year nearly 84% of total trust services security incidents had an impact on qualified services (i.e., qualified signature certificate creation, qualified seal certificate creation, etc.) with 37 incidents in qualified services and 7 incidents in non-qualified services. The distribution remains exactly the same to what was in 2023 with the same numbers in terms of percentages.

text: non-qualified services 16%

text: Qualified services 84%

text: Figure 14. Reported incidents affecting qualified v non-qualified services – 2024

text: 4. MULTIANNUAL TRENDS 2017–2024

text: ENISA has been collecting and aggregating trust services incident reports since 2016. In this section, we look at multiannual trends over the last 8 years, covering 2017–2024. The dataset contains a total of 287 reported incidents.

text: 4.1 ROOT CAUSE TRENDS

text: Root-cause categories, i.e., system failures, human errors, malicious actions and natural phenomena, are analysed over the period from 2017 to 2024. From 2017–2024 system failures represented 58% of all reported incidents, human errors represented 26% of all reported incidents, 15% involved malicious actions and 1% natural phenomena, as displayed in Figure 15.

text: Figure 15. Nature of reported incidents – trust services security incidents in the EU (reported from 2017–2024) Over the period of reference, out of 287 incidents reported: - system failures accounted for 166 of all reported incidents, - human errors accounted for 75 of all reported incidents, - 43 involved malicious actions, and - 3 involved natural phenomena.

text: Percentage trends of related incidents over the last 8 years are displayed in Figure 16, arranged by category.

text: Figure 16. Root-cause categories – trust services security incidents in the EU (reported from 2017–2024)

text: Over the years of trust services security incident reporting, the most common root cause has been system failures, with a total of 166 reported incidents. The percentage of system-failure-related incidents over the last 5 years has been steadily increasing.

text: Incidents concerning human errors have been steadily decreasing from around 40% in 2020 to 23% in 2024.

text: Natural phenomena is not a common root cause in trust services sector. From 2017–2024 only three incidents were reported, accounting for 1% of the total. No such incidents were reported since 2022.

text: Malicious actions vary across the years, with the peak of 38.9% observed during 2018 and a value as low as 5.6% recorded in 2020. In 2024, malicious actions were the root cause for 14% of the reported incidents with nine incidents. Since 2022 malicious actions remain stable at around 14%.

text: 4.2 IMPACT SEVERITY TRENDS

text: In the multiannual trend concerning the severity of impact, the EU cybersecurity incident taxonomy ( ) is again followed, where the severity of the impact has the following values: no impact, minor, large and very large impact. Over time, TSPs are reporting more incidents regardless of their severity, the only difference now being 2024, which for the first time shows a decline .

text: It should be noted that there is a mostly linear increase in large incidents (in yellow) over the course of the last 5 years from 3 incidents in 2020 to 27 in 2024.

text: Looking at large impact incidents (in yellow) we can clearly see a continued increase, reaching 27 incidents this year, despite the drop observed in 2020.

text: With respect to the very large impact incidents reported over time they seem to settle around 2 incidents per year.

text: For reference in terms of reported incidents, in 2023 we had reports from 27 member states and 3 EFTA countries, while in 2024 we have reports from 21 member states and 3 EFTA countries. This therefore, has an impact on the incidents we have received and the graphs that are displayed. Furthermore, the impact assessment methodology that supports Member States in evaluating incidents should be streamlined to ensure a consistent and comparable understanding of impact across all MS.

text: Figure 17. Severity of impact – trust services security incidents in the EU (reported from 2017–2024)

text: 4.3 IMPACT ON SERVICES TRENDS

text: In this section, the impact per service from 2017–2024 for reported incidents for trust services is detailed in Figure 18.

text: It is evident that the majority of reported incidents relate to electronic signatures, with numbers averaging around the 86%. This is probably due to the fact that electronic signatures are used for authorization of transactions, financial or otherwise, while electronic seals are mostly used to ensure integrity of data. Additionally, automation is usually used with electronic seals, while electronic signatures are quite extensively used by humans as well, which leads to more incidents.

text: Electronic seals show a steady declining trend coming to the lowest share of 6% over the 8 years.

text: Electronic timestamps seem to oscillate around the 11% over the 8 years of incident reporting.

text: 5. CONCLUSIONS

text: The key takeaways from the 2024 incident reports are as follows.

text: • Half of the EU Supervisory Bodies – 12 out of 24 (reported) – sent their respective reports with 0 incidents reported ( ). • The overall impact of the incidents accounted for 618 million user hours lost which is 5 times decrease over the 2023 where 3 184 million user hours lost were reported. • Malicious actions accounted for 92% of all hours lost in 2024 with 571 out of 618 million. • The number of large incidents continue to increase in the last 5 years. • Qualified trust services versus non-qualified trust services – in 2024, 84% of total incidents had an impact on qualified trust services.

text: ABOUT ENISA

text: ISBN 978-92-9204-707-8 doi: 10.2824/2144753