For the first time the EU issued sanctions against companies in North Korea and China, as well as the Department for special technologies of the Russian military intelligence service, as they were involved in significant cyber-attacks, or attempted cyber-attacks against the EU and its member states.

The EU sanctions regime was used to impose travel bans and asset freezes against six individuals, as well as asset freezes against three entities or bodies. According to the European External Action Service, ‘these individuals and entities have been involved in cyber-attacks against companies located in the EU, such as those known as WannaCry, NotPetya, Operation Cloud Hopper or the attempted cyber-attack against the Organisation for the Prohibition of Chemical Weapons (OPCW).’