Cybersecurity Dive reported on July 1, 2026 that a majority of surveyed cybersecurity workers say they have been directed to keep a security breach quiet rather than disclose it. The finding, drawn from an industry survey the outlet cited, spans practitioners across the profession rather than a single company or sector.
Executive Summary
The headline claim is stark: more than half of cybersecurity professionals in the survey say they have, at some point, been instructed to conceal a breach. If accurate, that behavior sits in direct tension with regulatory disclosure regimes, customer contracts, cyber insurance conditions, and the fiduciary duties boards owe shareholders.
For enterprise buyers of cloud, connectivity, and managed security services, the report reframes a familiar question. It is no longer only whether a vendor can detect and contain an incident, but whether the vendor’s culture and governance will actually surface one when it happens. That is a procurement and audit issue as much as a technical one.
Concealment Culture Meets a Disclosure Era
The last three years have layered new disclosure obligations on top of old ones. The U.S. Securities and Exchange Commission requires public companies to report material cyber incidents within four business days. The European Union’s NIS2 directive tightens reporting for critical infrastructure operators. State breach notification laws and sector rules for health care, banking, and telecoms add further triggers. A survey suggesting that most practitioners have been pressured to bury an incident implies a structural mismatch between what the rules require and what internal incentives reward.
The mismatch is easy to explain. Disclosure invites regulatory scrutiny, litigation, customer churn, and share-price impact. Silence, by contrast, is cheap in the short term and only expensive if the concealment is later exposed. Absent enforcement that is fast and predictable, rational actors under quarterly pressure will sometimes choose silence, and rank-and-file security staff will feel the weight of that choice.
What Buyers, Insurers, and Boards Should Actually Ask
For enterprise customers, the practical takeaway is that generic assurances about incident response are not enough. Contracts should specify notification triggers, timelines, and the identity of the executive who owns the decision to notify. Right-to-audit clauses, independent forensic requirements, and clear whistleblower protections for the vendor’s security staff all become more meaningful in light of a finding like this one.
Cyber insurers face a related problem. Policies typically require prompt notification of incidents; systematic concealment inside insured organizations undermines the actuarial basis of the product. Boards, meanwhile, should be asking their chief information security officers a direct question on the record: have you or your team ever been asked to withhold information about an incident, and what would you do if you were? The answer, and how freely it is given, is itself a governance signal.
Reading the Survey With Appropriate Skepticism
The finding deserves scrutiny in both directions. Self-reported survey data on sensitive workplace behavior is prone to selection bias: practitioners who have experienced pressure to conceal are more motivated to respond, and the definition of “pressure” can stretch from an explicit order to an ambiguous hallway conversation. Without the underlying methodology, sample frame, and question wording, the headline number is directional rather than definitive.
At the same time, dismissing the finding because the methodology is thin would be its own error. Multiple prior industry surveys, regulator enforcement actions, and post-breach litigation have documented cases in which disclosure was delayed or shaped for reasons that had little to do with investigative integrity. The honest reading is that the survey is a signal worth investigating, not a verdict, and that the burden now sits with both the researchers to publish their method and with enterprises to test the claim inside their own walls.
Background
Cybersecurity Dive is a trade publication covering enterprise security, regulation, and incident response. Industry surveys of security practitioners have become a recurring genre, often used to surface workplace and governance issues that formal disclosures do not capture. The findings typically inform how regulators, insurers, and boards frame their next round of questions to management.
The broader context is a decade of expanding breach notification law, from early U.S. state statutes to GDPR in 2018, the SEC’s 2023 incident disclosure rule, and NIS2 in the EU. Each regime has raised the legal cost of silence, even as commercial incentives to stay quiet remain strong.
Cybersecurity firm Resecurity has published research detailing a ransomware attack by the Anubis group against an Adriatic Port Authority, as reported by Industrial Cyber on June 16, 2026. The disclosure is being framed as a detailed look at how ransomware operators are reaching into maritime critical infrastructure — a sector where information technology (IT) systems and operational technology (OT, the systems that control physical processes like cranes, gates, and cargo handling) are increasingly intertwined.
Executive Summary
According to the report, threat-intelligence firm Resecurity has documented an intrusion attributed to Anubis — a ransomware-as-a-service operation that surfaced in underground markets in late 2024 and drew attention for pairing conventional encryption with a destructive file-wiping capability — against a port authority on the Adriatic coast. Port authorities are the public bodies that govern harbor operations, vessel traffic, and often the digital systems that commercial terminals depend on, which makes them an unusually consequential ransomware target.
The significance is less the individual incident than what it illustrates: ports sit at the junction of national logistics, customs, energy imports, and military mobility, and a single compromised authority can ripple across all of them. Vendor research that documents such an attack in technical detail is valuable to defenders — though, as with any single-vendor disclosure, the claims that matter most (scope of access, operational impact, and how the intrusion happened) deserve independent confirmation, and the public reporting available at publication is thin on those specifics.
Why Ports Are Ransomware’s Ideal Target
Modern ports run on software to a degree that surprises outsiders. Terminal operating systems schedule every container move; gate systems decide which trucks enter; berth management coordinates vessel arrivals; customs and port-community platforms link the authority to shippers, freight forwarders, and government agencies. When ransomware locks those systems, cargo does not merely slow — it physically stops, because cranes and yard equipment have nowhere to be told to go. That is why the sector’s precedents are so costly: the 2017 NotPetya incident forced Maersk to rebuild its global IT estate at a cost the company put in the hundreds of millions of dollars, and ransomware halted container operations at Japan’s Port of Nagoya in 2023. An Adriatic port authority fits the same profile: high downtime costs, public-sector budget constraints, and a web of third-party connections that widens the attack surface.
The OT dimension raises the stakes further. Even when attackers only encrypt IT systems, operators frequently shut down OT as a precaution because the boundary between the two is porous. The practical lesson for infrastructure operators of every kind — ports, data centers, utilities — is that segmentation between business networks and control networks is not a compliance checkbox; it is the difference between an expensive IT incident and a physical-operations outage.
Anubis and the Economics of Destructive Ransomware
Anubis is a relatively young ransomware-as-a-service brand — a model in which core developers lease their malware and infrastructure to affiliates who conduct the actual intrusions in exchange for a revenue share. What set Anubis apart in earlier security-industry reporting was a so-called wipe mode: the ability to destroy file contents outright rather than merely encrypt them. That capability changes the victim’s calculus. Classic ransomware is, in a grim sense, a negotiation with a counterparty that wants its decryptor to work; a wiper-equipped operator can credibly threaten permanent destruction, which increases pressure to pay quickly and raises the ceiling of potential damage if talks collapse.
For a critical-infrastructure victim, that threat profile pushes the incident out of the purely financial category and toward something closer to sabotage risk. It also strengthens the case for offline, regularly tested backups — the one control that removes most of a wiper’s leverage — and for incident-response planning that assumes data may be unrecoverable from the attacker regardless of payment.
What Vendor Research Does — and Doesn’t — Establish
This disclosure comes from Resecurity, a commercial threat-intelligence firm, relayed through trade press. Vendor research is a legitimate and often essential channel — private firms frequently see intrusion details that victims and governments do not publish — but it also serves a marketing function, and readers should hold it to the same evidentiary standard as any other claim. The fair questions cut in every direction: Has the affected port authority confirmed the incident? Do the technical indicators trace to Anubis with high confidence, or by resemblance to known tooling? Was operational technology actually touched, or is OT exposure an inference from network architecture? The public reporting available at the time of writing — an aggregated headline and summary — does not settle any of these, and it would be a mistake to treat the incident’s most dramatic possible reading as established fact.
The Regulatory Tide Meets the Waterline
If the affected authority sits in an EU member state — as most Adriatic port authorities do — the incident lands squarely inside the NIS2 directive’s remit, the EU regime that designates ports as essential entities and imposes incident-reporting deadlines and management-level accountability for cyber risk. The International Maritime Organization has likewise required cyber risk to be addressed in ship and port safety-management systems since 2021. An incident like this one becomes a live test of whether those frameworks produce faster disclosure and better resilience in practice, or whether public understanding of critical-infrastructure attacks continues to depend on third-party security researchers publishing what victims will not.
Background
Anubis appeared in cybercrime markets around late 2024 as a ransomware-as-a-service brand and was flagged by multiple security researchers in 2025 for combining data-theft extortion with an optional file-destruction mode — an escalation from the encrypt-and-negotiate model that has dominated ransomware for a decade. Maritime targets have figured in ransomware history since NotPetya crippled Maersk in 2017, and attacks on the ports of Lisbon (2022) and Nagoya (2023) demonstrated that both port authorities and terminal operators are viable victims.
The Adriatic coastline hosts significant EU trade gateways in Italy, Slovenia, and Croatia, making its port authorities essential entities under the EU’s NIS2 cybersecurity directive. Resecurity, the firm behind this disclosure, is a commercial threat-intelligence company that regularly publishes intrusion research on ransomware groups and critical-infrastructure targeting.
The Council of the European Union — the body where member-state governments negotiate EU legislation — is set to examine a cybersecurity package covering three fronts: the mandate of ENISA, the EU’s cybersecurity agency; simplification of the NIS2 directive, the bloc’s baseline cybersecurity law for critical and important sectors; and rules addressing security of the technology supply chain. The development was reported by Industrial Cyber on June 6, 2026.
Executive Summary
According to the report, EU member states are turning their attention to a package that bundles three of the most consequential threads in European cyber policy. The first is institutional: what ENISA, the European Union Agency for Cybersecurity, is empowered and resourced to do. The second is regulatory relief: “simplification” of NIS2, the directive that since 2023 has imposed risk-management and incident-reporting duties on energy, transport, health, digital infrastructure, and thousands of other entities. The third is supply chain security — the question of how Europe manages risk from the hardware, software, and service providers that critical operators depend on.
Why it matters: NIS2 is the compliance framework under which most European data centers, cloud providers, and network operators now live. Any change to its obligations, to the agency that coordinates its implementation, or to how vendor risk must be managed flows directly into the budgets and architectures of infrastructure operators — inside the EU and among the non-EU suppliers who sell into it. Council examination is an early but meaningful stage: it signals member states are engaging with the substance, and their negotiating position will shape whatever finally becomes law.
Why Brussels Is Revisiting Rules It Only Just Finished Writing
NIS2 entered into force in 2023, and member states were required to transpose it into national law by late 2024 — a process that ran late in much of the bloc. That a “simplification” effort is on the Council’s table so soon reflects a broader shift in EU policymaking: after a decade of expanding digital regulation (GDPR, NIS2, DORA, the Cyber Resilience Act), the political mood has turned toward reducing overlapping reporting duties and compliance costs, particularly for mid-sized firms, in the name of competitiveness.
For regulated entities, simplification cuts both ways. Streamlined incident reporting and deduplicated obligations across overlapping laws would be a genuine relief — many operators today face multiple reporting clocks for a single incident. But reopening a directive mid-implementation creates its own cost: companies that have spent two years building NIS2 compliance programs now face uncertainty about whether the target will move. The report does not detail which obligations would be simplified, so the practical effect remains an open question.
ENISA: From Coordinator to Something More?
ENISA has existed since 2004 and received a permanent mandate under the 2019 Cybersecurity Act, which also made it the steward of the EU’s cybersecurity certification schemes. But the agency has long been described as carrying responsibilities that outstrip its budget and headcount, and the Cybersecurity Act itself has been under review. A package that “reworks” the mandate suggests member states are deciding how much operational weight — in certification, vulnerability handling, incident support, or supervision — the agency should carry.
The stakes for industry are concrete. If ENISA’s certification role expands, cloud and hardware vendors could face new (or consolidated) EU-level assurance schemes rather than a patchwork of national ones. If its operational-support role grows, member states with thinner national capabilities gain a backstop. Either direction changes who infrastructure operators deal with when regulation and incidents intersect.
Supply Chain Security: The Hardest Problem in the Package
Supply chain security is where cyber policy meets geopolitics. Europe’s critical infrastructure runs on globally sourced components — chips, network equipment, software libraries, managed services — and recent years have demonstrated, from widely exploited software vulnerabilities to compromises of vendor update mechanisms, that attackers increasingly go through suppliers rather than at targets directly. NIS2 already obliges covered entities to manage supply chain risk, and EU bodies have previously conducted coordinated risk assessments of specific technology dependencies.
The unresolved question is instrument choice: guidance and risk assessments, procurement conditions, certification requirements, or exclusion of “high-risk” vendors, as some member states applied to 5G equipment. Each option distributes costs differently between operators, European suppliers, and non-EU vendors. The report does not indicate which approach the package takes — a gap worth watching closely, because vendor-exclusion regimes and certification mandates have far larger commercial consequences than guidance documents.
What Infrastructure Operators Should Take From an Early-Stage Signal
Council examination is not enacted law, and packages change substantially during negotiation between the Council, the European Parliament, and the Commission. The prudent reading for operators of data centers, networks, and cloud platforms is directional: EU cyber regulation is consolidating rather than retreating, the compliance perimeter will keep touching vendor relationships, and ENISA’s role in day-to-day industry interaction is likely to grow rather than shrink.
Practically, that argues for compliance programs built on durable fundamentals — asset inventories, tested incident response, documented vendor risk management — rather than narrow teach-to-the-test implementations of current NIS2 texts. Obligations drafted around outcomes tend to survive simplification exercises; paperwork drafted around specific reporting templates may not.
Background
The EU built its current cyber framework in layers: the original NIS directive of 2016 established the first bloc-wide security obligations; the 2019 Cybersecurity Act gave ENISA a permanent mandate and created an EU certification framework; and NIS2, in force since 2023 with national transposition due in late 2024, dramatically widened the set of regulated sectors and stiffened enforcement. Sector-specific regimes such as DORA for financial services and the Cyber Resilience Act for digital products followed, producing a dense — critics say overlapping — regulatory landscape.
By 2026, that density collided with a renewed EU focus on competitiveness and burden reduction, prompting reviews of recently adopted digital rules. The package now before the Council sits at that intersection: consolidating the institutional architecture around ENISA, easing NIS2 compliance mechanics, and confronting supply chain risk, which incidents of recent years have made a first-order concern for governments and critical-infrastructure operators alike.
Security Affairs reported on May 2, 2026 that Salt Typhoon — the threat actor Western governments have linked to Chinese state espionage — breached an IBM subsidiary in Italy. The report frames the intrusion as a warning for Europe’s digital defenses, signaling that a campaign best known for compromising U.S. telecommunications carriers is now reaching into the European enterprise technology sector.
Executive Summary
According to the Security Affairs report, an Italian subsidiary of IBM — one of the world’s largest enterprise IT and consulting companies — was compromised by Salt Typhoon, a hacking group that U.S. agencies have attributed to China’s state security apparatus. The report positions the incident less as an isolated breach and more as evidence that Chinese state-aligned intrusion campaigns are expanding beyond American telecom networks into Europe’s corporate and IT-services core.
Why it matters: IT-services and consulting firms sit inside the trust boundary of hundreds or thousands of client organizations. A foothold in one such firm can become a staging point for espionage against banks, governments, telecoms, and critical infrastructure downstream. If the attribution holds, this is the kind of supply-chain-adjacent intrusion that European regulators designed the NIS2 directive — the EU’s updated cybersecurity law for essential and important entities — to surface and contain. The public reporting, however, is thin on specifics, and the material questions remain open.
From Phone Networks to the Enterprise Back Office
Salt Typhoon earned its notoriety through a sweeping campaign against U.S. telecommunications carriers, disclosed beginning in late 2024, in which intruders reportedly reached systems used for lawful intercept — the infrastructure carriers maintain to comply with court-ordered wiretaps. That campaign established the group’s signature: patient, infrastructure-level espionage aimed at the systems that other systems depend on. A breach of an IBM subsidiary in Italy, if confirmed in the terms reported, would fit that pattern while marking a geographic and sectoral expansion — from American carriers to a European arm of a global IT-services giant.
The logic is straightforward. An IT-services firm holds privileged credentials, remote-access pathways, and architectural knowledge for its clients. Compromising one is economically efficient espionage: a single intrusion can yield visibility into many organizations at once. Security practitioners call this a trusted-relationship or supply-chain attack, and it has been a recurring theme in state-linked campaigns for a decade.
What the Report Establishes — and What It Doesn’t
It is worth being precise about the evidentiary picture. The public reporting names the actor (Salt Typhoon), the victim category (an IBM subsidiary), and the location (Italy). It does not, in the material available, name the specific subsidiary, describe the intrusion method, quantify what was accessed, or state whether client environments were touched. Attribution to a specific state-linked group is a technical judgment that typically rests on tooling, infrastructure overlaps, and tradecraft — evidence the public report does not lay out. None of that means the report is wrong; it means readers should treat scope and impact as unestablished until the company or a government agency speaks on the record.
That caution cuts both ways. Vendors and victims have incentives to minimize; incident reporting sometimes outruns confirmed facts. The responsible reading on May 2, 2026 is that a credible security outlet has flagged a serious claim that warrants verification, notification, and follow-up — not that the full blast radius is known.
Europe’s Regulatory Moment Meets Its Threat Moment
The timing lands squarely in Europe’s post-NIS2 era. The directive, which EU member states were required to transpose into national law by late 2024, obliges essential and important entities — a category that captures much of the IT-services sector — to report significant incidents on tight timelines and imposes management-level accountability. Italy’s national cybersecurity agency, ACN, is among the bodies that would ordinarily be in the notification chain for an incident of this description, alongside GDPR obligations if personal data were involved.
For buyers of IT services, the practical takeaway is not to churn vendors on the strength of a single report. It is to exercise the rights modern contracts and regulations already provide: ask providers directly about exposure, review the privileged access those providers hold, and verify that monitoring covers the vendor-facing pathways into your own environment. State-aligned espionage campaigns target the seams between organizations; that is where defensive attention should concentrate.
Background
IBM is one of the world’s largest enterprise technology companies, operating consulting, software, and infrastructure businesses through subsidiaries in most major markets, including Italy. Salt Typhoon entered public awareness in late 2024, when U.S. officials disclosed that the China-linked group had penetrated major American telecommunications carriers in what some officials described as among the most serious telecom intrusions on record. Western governments have attributed the group’s activity to Chinese state intelligence interests, a characterization Beijing has consistently denied.
The reported Italian incident arrives as Europe implements NIS2, its toughened cybersecurity regime for critical and important sectors, and as governments on both sides of the Atlantic warn that state-aligned actors are pre-positioning inside infrastructure and service-provider networks. IT-services firms occupy a particularly sensitive position in that landscape because their access spans so many client organizations at once.
