In the EU, telecom operators notify significant security incidents to the National Regulatory authority (NRA) in their country. At the start of every calendar year, the national authorities for telecom security send a summary about these incidents to ENISA. This document, the Annual Report Telecom Security Incidents 2019, covers the incidents reported by the authorities for the calendar year 2019 and it gives an anonymised, aggregated EU-wide overview of telecom security incidents.

Security incident reporting has been part of the EU’s telecom regulatory framework since the 2009 reform of the telecom package: Article 13a of the Framework directive (2009/140/EC) came into force in 2011. The incident reporting in Article 13a focuses on security incidents with significant impact on the operation of services, i.e. outages of the electronic communication networks and/or services.