Austria’s Interior Ministry is reeling from a cyberattack disclosed over the weekend, a breach that has revived scrutiny of the country’s failure to implement the European Union’s latest cybersecurity directive on time, as reported by OE24.
The directive, known as NIS-2, was meant to be written into national law by October 2024, but Austria missed the deadline. A government bill collapsed in parliament last year after falling short of the necessary two-thirds majority. That setback left the Interior Ministry exposed, critics argue, though whether the legislation would have made any difference remains unclear.
“That’s speculation,” said Nikolaus Forgó, professor of technology law at the University of Vienna, in an interview with ORF’s Ö1 Mittagsjournal. He added that information security awareness across European administrations still lags behind what is needed. According to Forgó, most EU member states are behind on adopting NIS-2, largely because it assigns direct responsibility to leadership in the event of violations. “That obligation alone doesn’t guarantee greater security,” he said. “But if it’s missing in national law, it may at least suggest that those targeted were less careful.”
The ÖVP-led Interior Ministry, however, insisted the attack could not have been prevented, even under stricter rules. Officials confirmed that the bill has been redrafted and is now under negotiation with coalition partners SPÖ and NEOS. Both parties rejected the earlier version last year when the government lacked their support.
The renewed talks come at a time of heightened vulnerability. Across Europe, public institutions have faced increasingly sophisticated cyber intrusions, with security experts warning that delays in implementing NIS-2 create dangerous gaps in national defenses.
For Austria, the cyberattack has underscored both the urgency of legal reform and the high cost of political gridlock.
