The European Parliament on 17 June 2026 debated the protection of EU citizens' data from hybrid threats, centering on a major data breach in Lithuania where over 600,000 records from the national register were stolen. Renew MEP Petras Auštrevičius criticized Lithuanian authorities for delaying notification to affected citizens from April to May 2026, questioning why the breach was hidden. Council Deputy Minister Marilena Raouna highlighted the EU's legislative cyber framework and the proposed cybersecurity package, stressing the need for coordinated response via hybrid rapid response teams and the European Democracy Shield. Commissioner Michael McGrath (Justice) outlined EU tools including NIS2, the Cyber Resilience Act, and the Cyber Solidarity Act, and announced upcoming proposals to strengthen Eurojust and Europol.
MEPs from across the political spectrum diverged on national implementation gaps and political responsibility. EPP MEPs Liudas Mažylis and Vytenis Povilas Andriukaitis, along with S&D's Julie Rechagneux, Renew's Dainius Žalimas, ECR's Aurelijus Veryga, and Greens-EFA's Virginijus Sinkevičius, all raised concerns about slow national responses and insufficient coordination. PfE MEP Petras Gražulis blamed liberal-conservative governments for ignoring 2024 cybersecurity recommendations. Several MEPs called for stronger EU-level guidelines, faster information sharing, and investment in cyber resilience. The debate underscored the need for a united European response to hybrid attacks targeting citizens' data and democratic trust.
The breach, which exposed sensitive personal data, has heightened tensions between national sovereignty and EU-level oversight. While some MEPs argued for stricter EU mandates to compel timely breach notifications, others cautioned against overcentralization. The Commission's upcoming proposals to strengthen Eurojust and Europol aim to enhance cross-border investigation and coordination, but implementation remains uneven. The debate highlighted a cleavage between those prioritizing rapid EU intervention and those defending national discretion, with implications for citizens' data security and institutional trust. The Parliament is expected to follow up with a resolution or recommendations in the coming weeks.