Opens in a new tab

Breaking news

Cyber Resilience In Cyprus Tested By Rising Cyberattacks

Escalating Cyber Threat Landscape

Recent nationwide surveys conducted by the Communications Commissioner and the Digital Security Authority reveal that cyberattacks in Cyprus are not only frequent but are intensifying. Over the past 12 months, one in three individuals and more than half of businesses reported experiencing a cyber incident, highlighting growing pressure on digital security systems.

Business Under Siege

A survey of 459 companies across multiple sectors, conducted between September and November 2025, found that 53% experienced a cyberattack or data breach within the past year. The figure marks an increase from 47% in 2024 and 49% in 2023.

On average, businesses reported one cyberattack every eight days, compared with one every 10 days a year earlier. Among affected companies, 51% reported financial losses averaging €12,000, slightly lower than previous results.

Phishing remains the most common attack method, accounting for 44% of incidents. Although the share has declined slightly, 75% of companies said phishing was the most recent form of attack they encountered.

The survey also found gaps in preparedness. Nearly one in four organizations had not updated cybersecurity policies in more than a year, while only 22% participated in cybersecurity training initiatives in 2025. Companies that invested in training reported stronger defensive outcomes.

Individual Vulnerability

A separate survey of 1,043 individuals conducted between August and September 2025 showed that people faced an average of 25.9 cyberattack attempts during the year, slightly below previous levels.

Around one-third of respondents said they had been affected by a cyber incident, with 17% reporting financial losses averaging €141. The 35–44 age group recorded the highest financial impact, marking a shift from earlier trends that showed higher exposure among younger users.

Phishing remained the leading attack method for individuals, representing 22% of incidents.

Despite widespread exposure to cyber risks, awareness levels remain limited. Among respondents who had not experienced an attack, 89% said they were uncertain about their future online safety. In addition, 74% were unaware of available cybersecurity training programs.

Those who attended seminars reported practical changes, including stronger password practices, regular updates, and increased caution when interacting with unfamiliar online environments.

Strengthening Cybersecurity Measures

In response, the Digital Security Authority plans to expand educational outreach through seminars and awareness campaigns aimed at both businesses and individuals.

The initiative is designed to strengthen cybersecurity resilience across Cyprus as organizations and consumers face a growing volume of digital threats.

Cyprus Company Registration: Two To Four Days, Unless Security Checks Intervene

Cyprus aims to register companies within two to four working days when applicants submit complete documentation. However, regulatory approvals, sanctions checks, foreign ownership and national security considerations can extend the process or prevent registration.

Energy, Commerce and Industry Minister Michael Damianou outlined the timeframe in a written response to MP Efrem Christou, who asked about company formation procedures and the checks required before approval.

Fast Registration Depends On Complete Documentation

Damianou said authorities seek to process complete applications within two to four working days, regardless of a company’s structural complexity. The timeframe also depends on whether applicants pay an additional fee for expedited processing.

According to the official incorporation requirements, the standard registration fee is €165, rising to €235 for companies without share capital. Expedited processing costs an additional €100.

Applicants must submit an approved company name, a memorandum and articles of association, and forms HE1, HE2 and HE3. Public companies must also provide form HE5.

Regulated Businesses Require Additional Approval

Companies operating in certain sectors must obtain prior clearance from the relevant authorities or professional bodies. These include medical and dental businesses, law firms, insurance and reinsurance companies, and firms supervised by the Cyprus Securities and Exchange Commission.

The Central Bank of Cyprus must also approve company names associated with payment institutions, electronic money and foreign exchange services. Additional restrictions apply to educational institutions using terms such as “university” or “college”, casino operators, broadcasters and wine producers.

Non-profit organisations seeking to register without “Limited” or “Ltd” in their names also require ministerial authorisation.

Sanctions And Foreign Ownership Trigger Extra Checks

Applications involving shareholders, directors or company secretaries subject to EU, UN or US sanctions receive additional scrutiny. Registration can proceed only if the competent sanctions authority does not prohibit it. Damianou noted that US sanctions are considered indirectly but have not been incorporated into Cyprus legislation in the same way as EU and UN restrictions.

Applications involving Turkish interests are also subject to additional review. Under procedures introduced around 20 years ago, the registrar must consult national security services before proceeding with registrations involving Turkish interests or businesses that could threaten the Republic’s security.

Damianou distinguished these cases from applications submitted by Turkish Cypriots, saying there is “no substantial difference” in how their registration documents are examined. Applications may nevertheless be refused if classified information raises concerns about national interests or national security.

Public Servants Face Separate Restrictions

Under Article 65 of the public service law, government employees cannot act as directors, company secretaries or shareholders in private or public companies without prior special permission from the finance minister.

Proposed Law Would Expand Registrar’s Powers

The government is also seeking to strengthen the Registrar of Companies’ authority to address potential security risks. An amendment to the companies law, submitted to Parliament on September 17, would allow the registrar to reject applications, refuse company filings or remove existing businesses from the register on grounds including national security, public order, public interest and the protection of state sovereignty.

The proposal, approved by the Council of Ministers on August 6, remains before the House commerce committee. It would allow authorities to withhold detailed justifications where disclosure could reveal sensitive information, while informing affected companies of the general grounds for decisions.

The bill follows parliamentary discussions about companies controlled by non-EU nationals, particularly those with Turkish ultimate beneficial owners, and possible implications for property ownership through foreign-controlled businesses. Further details are available in the proposed amendment and earlier parliamentary reporting.

Balancing Investment And Oversight

Cyprus is seeking to maintain an efficient company registration process while strengthening checks on ownership, sanctions compliance and potential security risks.

The two-to-four-day target supports the country’s appeal to entrepreneurs and international investors, but the actual timeline depends on the nature of the business, the documentation submitted and any additional regulatory or security reviews required.

The Future Forbes Realty Global Properties
Aretilaw firm
Uol
eCredo

Become a Speaker

Become a Speaker

Become a Partner

Subscribe for our weekly newsletter