10 written questions · 2018–2026 · last question 26 Jun 2026
Cyber resilience, NIS and DORA
From the 2018 DDoS scrubbing centre to the 2025 DDoS on state services and the POST outage, questions probe critical-infrastructure protection. Incident reporting under NIS and DORA is a recurring theme.
Outcome so far
DORA reporting live: 326 major ICT incident notifications to the CSSF since Jan 2025 (QP 4160); 27 NIS notifications to the ILR in 2025, no sanctions (QP 4332).
Status
Answered; QP 4554 (cybersecurity of conventioned managers) pending.
What I'm asking next
Why no sanctions under NIS/DORA, and when NIS2 enforcement starts.
The questions
Newest first. Each question links to the full text and the government's answer on chd.lu (in French); the summaries are ours. Question numbers restart with each legislature.
-
· QP 4332 · to Luc Frieden
Notification des incidents de cybersécurité (NIS1)
Answer: 27 notifications in 2025, 11 significant; no sanctions.
-
· QP 4160 · to Gilles Roth
Bilan des notifications DORA à la CSSF
Answer: 326 major ICT incidents notified since 17 Jan 2025; no sanctions.
-
· QP 4101 · to Stéphanie Obertin
Incident Thales/LuxTrust et sécurité des données des utilisateurs luxembourgeois
Answer: No impact on LuxTrust users; NIS2 24-hour reporting applies.
-
· QP 2735 · to Lex Delles
Cyberattaque contre POST et impact sur les infrastructures critiques
Answer: Emergency calls routed; gaps acknowledged, improvements needed on resilience and communication.
-
· QP 1764 · to Stéphanie Obertin
Attaque DDoS
Answer: State online services down 13:05-14:55 on 10 Jan 2025; LuxTrust also disrupted.
-
· QP 544 · to Stéphanie Obertin
Centre national de mitigation des attaques DDoS pour les situations de crise
Answer: Luxembourg well prepared for massive DDoS attacks.
-
· QP 6596 · to Claude Turmes
Cyberattaque sur Creos et Enovos
Answer: Stolen data included basic customer data; analysis ongoing.
-
· QP 2250 · to Xavier Bettel
Les infrastructures critiques
Answer: Names of designated essential operators not published for security reasons.
-
· QP 1822 · to Xavier Bettel
Les infrastructures critiques
Answer: Refers to the NIS transposition law of 28 May 2019.
-
· QP 38 · to Xavier Bettel
Le DDoS-Scrubbing Center
Answer: Scrubbing centre planned under the national cybersecurity strategy.