Quick answer: yes. Today's wars are also fought online, and the attacks do not stop at borders. A company with no connection to a conflict can suffer collateral damage, be targeted by "hacktivist" groups because its country supports one side, or receive scam emails that exploit the news. In the European Union, around 80% of the incidents analysed by ENISA between July 2024 and June 2025 were hacktivism.

When an armed conflict breaks out, a wave of cyberattacks often follows: some launched by states, others by volunteer groups supporting one side, and others by criminals taking advantage of the confusion. This article explains how this can reach a business and what you can do to protect yourself.

How does a war reach a company's computers?

There are three main routes:

  1. Collateral damage. An attack aimed at one country or company spreads to suppliers, customers and partners worldwide.
  2. Hacktivism. Politically motivated groups attack countries that support the other side, often taking down company and government websites (DDoS attacks).
  3. Espionage and opportunism. Attempts to steal information increase, as do fake emails themed on the conflict, such as fake donation requests or fake urgent news.

Three real examples

NotPetya (2017): companies with no link to the conflict

It entered through a tampered update of Ukrainian accounting software and spread to companies worldwide that simply did business with Ukraine. It destroyed data instead of encrypting it and caused damage estimated at around 10 billion dollars. The US and UK governments attributed it to the Russian military.

Viasat satellites (2022): wind turbines offline in Germany

On 24 February 2022, the day of the invasion of Ukraine, thousands of KA-SAT satellite internet modems stopped working. The attack targeted Ukraine but hit customers across Europe: in Germany, remote control of around 5,800 wind turbines was lost. The European Union, the US and the UK attributed the attack to Russia. The attackers got in through a misconfigured VPN.

Middle East (2025): a hundred groups in a few days

During the conflict between Israel and Iran in June 2025, around 100 hacktivist groups mobilised in the first days, with an average of 30 DDoS attacks claimed per day. The attacks did not stay within the two countries: targets in the US, the UK, Jordan and Egypt were also hit.

What about Europe and Portugal?

The annual report by ENISA, the EU cybersecurity agency, analysed 4,875 incidents between July 2024 and June 2025:

  • Around 80% were hacktivism, mostly low-impact DDoS attacks on websites.
  • Many of these campaigns arose in the context of European support for Ukraine, led mainly by the pro-Russian group NoName057(16).
  • Ransomware remains the most impactful threat in the EU.
  • Phishing (fake emails) was the entry point in around 60% of intrusions.

In July 2025, Europol coordinated the international Operation Eastwood against NoName057(16): several hundred servers were taken offline and Germany issued six arrest warrants.

In Portugal, the National Cybersecurity Centre (CNCS) recorded campaigns by pro-Russian groups in 2024, mainly DDoS attacks and website defacements. For 2025, it warned of rising cyber espionage linked to conflicts and of politically motivated groups using the same tools as criminals, including ransomware.

Is a small business really at risk?

It is rarely the main target, but it can be hit in several ways:

  • Through suppliers: software, cloud services or your IT provider can be the way in, as with NotPetya.
  • Through infrastructure: an internet, power or communications outage can stop the business, as in the Viasat case.
  • Through the website: a DDoS attack can take your website or online shop offline for hours.
  • Through email: criminals use current events to trick employees.

How to protect your business

  1. Backups with one copy off the network, tested regularly. This is what saves the business when everything else fails.
  2. Update VPNs, firewalls and routers, not just computers. The Viasat attack came in through a VPN.
  3. Two-factor authentication on email, remote access and administrator accounts.
  4. DDoS protection for your website: ask your hosting provider for a plan with built-in protection or use a content delivery network (CDN).
  5. Know your technology suppliers: what access they have to your network and how they protect themselves.
  6. Train your team to be wary of urgent emails about news, donations or payments.
  7. Have a continuity plan, including a backup internet connection (for example 4G/5G) for critical operations.
  8. Follow official security alerts and stay in touch with whoever manages your IT.