Article 3

The factors determining whether a cyber-attack has a significant effect as referred to in Article 1(1) include any of the following:

1. (a)

   the scope, scale, impact or severity of disruption caused, including to economic and societal activities, essential services, critical State functions, public order or public safety;

2. (b)

   the number of natural or legal persons, entities or bodies affected;

3. (c)

   the number of Member States concerned;

4. (d)

   the amount of economic loss caused, such as through large-scale theft of funds, economic resources or intellectual property;

5. (e)

   the economic benefit gained by the perpetrator, for himself or for others;

6. (f)

   the amount or nature of data stolen or the scale of data breaches; or

7. (g)

   the nature of commercially sensitive data accessed.