Ukraine ranked third worldwide and first in Europe among the countries most frequently targeted by cyberattacks, according to the Microsoft Digital Defense Report 2026

November, 2026

According to the study Microsoft Digital Defense Report 2026, Ukraine ranked third in the world and first in Europe among the countries most frequently targeted by cyberattacks. The study was conducted among Microsoft customers in the first half of 2026. In total, Ukraine accounted for 4.8% of all cyberattacks recorded in the world, a significant part of which is associated with the activities of Russian hacker groups.

According to the report, the main targets of cybercriminals are government institutions and the services they provide, the IT sector, research and education institutions, communication infrastructure, the transport sector, non-governmental organizations, the defense-industrial complex, critical industries and the financial services sector. Small and medium-sized businesses also remain at high risk of cyberattacks, in particular, they are most often victims of ransomware and Business Contact Impersonation fraud.

Key findings of the Microsoft Digital Defense Report 2026:

63% of cyber breaches were accompanied by data theft;

the share of phishing attacks among recorded intrusions has increased significantly - from 7% in 2025 to 23% in the first half of 2026. At the same time, 89-95% of phishing attachments in emails were aimed not at distributing malware, but at stealing credentials;

In 52.2% of breaches using valid accounts, attackers also stole credentials from other users, demonstrating how quickly a compromise of one account can lead to an organization-wide cyberattack.;

Artificial intelligence reduces the time available to respond to cyber threats. AI allows attackers to work faster – the time between discovering a vulnerability and actively exploiting it to launch a cyberattack can be significantly less than 24 hours.

Ukraine ranked second among the countries most frequently targeted by Russian hacking groups operating with the support of the aggressor country. Russian cyber operations are largely aimed at achieving Moscow's military goals in the war against Ukraine. The report also notes that Russian cyber attacks are becoming more covert, adaptive and effective, in particular, the enemy is increasingly using AI to increase the speed and scale of its cybercrimes.

Top 10 countries most frequently targeted by Russian state-run hacking groups

Only in 2025 National Cyber Incident Response Team CERT-UA, operating under the State Special Communications Service, has worked out 5,927 cyber incidents. One of the most common entry points for attackers was software products of Russian origin, which are still used today. about 90% of Ukrainian enterprises.

That is why, Innoware – a consulting company with over twenty-five years of experience in implementing ERP, CRM and HR systems Microsoft Dynamics 365 focuses the attention of managers and owners of Ukrainian enterprises on risks posed by the continued use of Russian software, and recommends planning and starting a project to transition from hostile software to technological and secure products from Microsoft.

For advice on transitioning from 1C/BAS and any others ERP-, CRM– yes HR-systems developed by the aggressor country to modern and safe solutions Microsoft Dynamics 365, as well as calculating the cost of the project specifically for your company, please call+380 (44) 490 2220or write toinfo@innoware.com