iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
On 16 March 2026, the Council of the European Union listed three companies—two based in China and one in Iran—and two Chinese individuals under its cyber-sanctions regime. The Council attributed hacking-related conduct to the listed parties; these are the Council’s stated listing reasons, not findings established here as court judgments.
Who the EU listed on 16 March 2026?
The Council’s announcement covered three entities and two individuals. It described the individuals as co-founders of Anxun Information Technology. The conduct below reflects the Council’s account in its 16 March press release.
| Listed party | What the Council said |
|---|---|
| Integrity Technology Group (China) | The company routinely provided products used to compromise and access devices in EU member states, elsewhere in Europe, and worldwide. The Council said its technical and material support was used to hack more than 65,000 devices across six member states between 2022 and 2023. Council press release |
| Anxun Information Technology (China) | The Council described the company as providing hacking services targeting critical infrastructure and critical state functions in EU member states and third countries. It described the two Chinese individuals listed alongside the company as its co-founders and as responsible for or involved in attacks affecting EU member states. Council press release |
| Emennet Pasargad (Iran) | The Council said the company unlawfully accessed a French subscriber database and advertised its contents for sale on the dark web; compromised advertising billboards to spread disinformation during the 2024 Paris Olympic Games; and compromised a Swedish SMS service, affecting many EU citizens. Council press release |
What does the 65,000-device figure mean?
The figure is the Council’s report that Integrity Technology Group provided technical and material support used to hack more than 65,000 devices across six EU member states during 2022–2023. It is a Council-attributed statistic about that company and period, not a count of devices independently established by this article or a figure for all three listed firms.
What do the EU cyber sanctions do?
The Council’s horizontal regime can target people or entities responsible for, supporting, or otherwise involved in cyber-attacks or attempted attacks. Its stated scope covers attacks with significant impact that constitute an external threat to the EU or its member states. The restrictions include:
#1 Best Overall
- Asset freezes on listed people and entities.
- Travel bans for listed individuals.
- A prohibition on making funds or economic resources available to listed parties by EU persons and companies.
The Council’s 16 March 2026 release stated: “Those listed today under both regimes are subject to an asset freeze, and EU citizens and companies are forbidden from making funds, financial assets or economic resources available to them.” The release attributed this statement to the Council, not to a named individual speaker. Read the release.
The Council established the cyber-sanctions framework in May 2019. It is distinct from the EU’s cyber diplomacy toolbox, which dates to June 2017. The March 2026 action concerned listings under the sanctions framework. Council overview of sanctions against cyber-attacks
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How did the sanctions list change after March?
- 16 March 2026: The Council announced listings of three entities and two individuals.
- 11 May 2026: The Council timeline recorded an extension of the sanctions against cyber-attack actors until 18 May 2027. Council overview
- 13 July 2026: Council Decision (CFSP) 2026/1713 added eight natural persons and four entities. The Official Journal act describes them as responsible for, supporting, or involved in cyber-attacks with significant effect constituting an external threat to the Union or member states. Read Decision (CFSP) 2026/1713
As shown on the Council policy page last reviewed on 13 July 2026, the regime covered 27 individuals and 11 entities and was extended until 18 May 2027. That total includes additions after the March announcement; sanctions lists can change over time. Council overview of the regime
Recommended Free Tools
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
