Lithuania recorded a 25% fall in cyber incidents last year compared with 2024, but breaches affecting organisations and legal entities nearly doubled, according to a national cyber security report published on Tuesday.
The findings, released by the National Cyber Security Centre, present a mixed picture: overall incident numbers have declined, possibly reflecting growing awareness, but risks within organisations have risen sharply, driven largely by human error and weak security practices.
A total of 2,888 cyber incidents were recorded, the majority linked to foreign-hosted infrastructure used to distribute malicious content. 19 were classified as major incidents. Incidents affecting legal entities, however, rose from 155 to 280 – a near-doubling that the centre said points to organisations remaining the most vulnerable point in the system.
In state digital infrastructure, 267 incidents involving disruption or hacking attempts were recorded.
“Even as technological resilience grows, the greatest risk remains related to human behaviour, vigilance and the ability to recognise deception schemes,” the report said.
Human manipulation remains the primary weapon
More than half of all incidents involved social engineering – the manipulation of human psychology to obtain unauthorised access to information – although the overall number of such cases fell by nearly a third year on year
The centre identified more than 106,000 leaked login credentials and alerted 221 organisations, warning that such data is routinely exploited by hostile actors for follow-on attacks, profiling and further social engineering.
Cybercrime overall fell by 28%, but fraud remained the dominant category, accounting for 44% of cases. Total financial losses reached €58.8m, with residents losing around €20.5m.
Authorities also reported a significant rise in the blocking of fraudulent communications, with intercepted scam calls up 63% and fraudulent SMS messages up nearly 80%.
Data breaches affected 713,000 people
According to the Data Protection Authority, 223 personal data breach notifications were received last year, affecting around 713,000 people. Most cases involved unauthorised access, social engineering and ransomware.
The Communications Regulatory Authority also reported a sharp increase in cyberbullying, with confirmed cases roughly tripling year on year.
Of 153 information systems assessed for vulnerabilities, 98 were found to contain weaknesses. The highest concentrations were found in healthcare and the food production and distribution sector. Across critical and highly important sectors – including digital infrastructure, public administration, banking, healthcare and transport –73 incidents were recorded, 13 of them classified as major.
Threat level remains yellow
Despite the overall improvement in incident numbers, Lithuania's cyber threat level remains at a moderate, or yellow, rating, characterised by increased cyber activity and isolated significant incidents or vulnerabilities.
The report warned that threats are likely to become more sophisticated in 2026, driven in particular by the growing use of artificial intelligence by hostile actors and increasing exposure through supply chains.
Newsletter
Every Friday morning.
