Phishing campaigns: what NIS 2 and DORA require

In Luxembourg, the Grand Ducal Police recorded 367 phishing complaints in 2025, up from 247 the year before. According to the ministers' joint answer of 15 April 2026 to parliamentary question no. 3691, the Police estimates losses since August 2023 at around ten million euros, and probably more. Since 1 January 2026, 7,932 phishing emails have been reported in Luxembourg through SpamBee (NC3 observatory counter, read on 20 October 2026). On 9 October 2026, the cyberfraud.lu working group, led by the Luxembourg House of Cybersecurity, launched the 2026 edition of the national awareness campaign against online fraud, under the slogan "Don't Click. Check. Report."

Companies are still poorly prepared: in 2024, only 22% of Luxembourg enterprises with 10 or more persons employed (financial sector excluded) made their staff aware through compulsory training or material, compared with 24.5% across the EU, and 45% did not make staff aware of their ICT security obligations at all (Eurostat). The question is no longer whether your people will receive these messages, but whether you can prove you prepared them.

That is what a phishing simulation campaign, also known as a phishing test, is for: a fake phishing email, sent in a controlled setting, to measure reflexes and train them. It complements a phishing awareness campaign; it does not replace it. Here is what the law actually requires, what phishing looks like in 2026, what research says about how well simulations work, and how to run a campaign without breaching the GDPR or Luxembourg labour law.

Does the law require a phishing campaign? The short answer

• No text says "phishing simulation". Neither the NIS 2 directive, nor the Luxembourg law of 5 May 2026, nor DORA, nor the GDPR imposes this method as such.
• Training, on the other hand, is mandatory. The Luxembourg NIS 2 law requires cybersecurity training and regular staff training; DORA requires compulsory awareness modules for all employees and senior management.
• Effectiveness must be demonstrable. NIS 2 requires procedures to assess the effectiveness of measures, the GDPR, as appropriate, a process for regularly testing it, and Implementing Regulation (EU) 2024/2690 requires the awareness programme of the digital providers it covers to be tested, where appropriate.
• The ILR, Luxembourg's main NIS 2 supervisor, cites phishing simulations as evidence. Its template for describing security measures (August 2026) gives them as an example of supporting evidence. It is a reference template, not an obligation.
• A campaign needs legal preparation. It processes employee data: it needs a GDPR legal basis and, if individual reactions are tracked, the prudent course is to inform the staff delegation beforehand (Article L. 261-1 of the Labour Code). We recommend never sanctioning a click.

In other words, the simulation is not the obligation: it is the most direct way to prove you meet it.

What the Luxembourg law of 5 May 2026 (NIS 2) requires

The NIS 2 directive was transposed by the law of 5 May 2026 on measures to ensure a high level of cybersecurity, published in Mémorial A no. 225 of 6 May 2026, in force since 10 May 2026 according to the ILR. It covers essential and important entities, public administration entities within the meaning of the law (always classed as essential), and critical entities, which are also essential whatever their size.

Two training duties, one of which goes further than the directive

• Article 12(2), point 7°: the minimum risk-management measures include basic cyber hygiene practices and cybersecurity training, and the measures must take account of the state of the art (Article 12(1)). Point 6° of paragraph 2 also requires policies and procedures to assess the effectiveness of cybersecurity risk-management measures. Article 12 transposes Article 21 of the directive.
• Article 13(2): members of management bodies must take training regularly, and essential and important entities must regularly offer similar training to their staff. Article 20 of the directive only asked Member States to encourage entities to offer such training to their staff: Luxembourg makes it an obligation. The management body approves and supervises the measures and can be held liable (Article 13(1)).

The law never mentions phishing or simulations. The word "phishing" appears only in recital 89 of the directive, which encourages raising staff awareness "concerning cyber threats, phishing or social engineering techniques". A recital is not legally binding.

What evidence the ILR expects

Essential entities notify their measures to the ILR (Article 12(3)); according to the ILR, they submit their deliverables every year (measures in place, analysis of risk scenarios, action plan). Important entities are supervised after the fact, but must be able to produce their evidence on request (Article 23). The templates the ILR published on 3 August 2026 show what will be looked at:

• in the "Description of the measures in place" template, objective SO-29 gives "Campaigns (simulated phishing, e-learning) and participation rates" and "Testing of the programme's effectiveness" as examples of evidence;
• in the template for analysing the main cyber risk scenarios, phishing is one of the ten pre-filled generic scenarios (SCG-S02, phishing that uses social engineering to compromise staff accounts);
• the ILR guidelines for management bodies (version of 17 February 2026) list phishing among the cyberattacks that management training should cover.

The ILR states that the templates are offered as a reference. The draft regulation that would set an annual notification of measures by 15 March went through a consultation that closed on 31 August 2026; as of 20 October 2026, it has not been adopted.

Penalties

A breach of Article 12, which includes cybersecurity training, can lead to a fine of up to 10 million euros or 2% of total worldwide annual turnover in the preceding financial year for an essential entity, and 7 million euros or 1.4% for an important entity, whichever is higher (Article 26). A breach of Article 13 (management approval of the measures, training of management and staff) can lead to a warning, a reprimand or a fine of up to 250,000 euros (Article 25). A periodic penalty payment of up to 1,250 euros a day, capped at 25,000 euros, can be added (Article 26(7)). What is sanctioned is the absence of training and measures, never the absence of one particular simulation.

Digital providers: an effectiveness test in black and white

Implementing Regulation (EU) 2024/2690 goes further for a closed list of digital providers: DNS service providers, top-level domain name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, search engines, social networking platforms and trust service providers. Its Annex requires an awareness programme that is repeated over time and covers new employees (point 8.1.2), then adds: "The awareness raising programme shall, where appropriate, be tested in terms of effectiveness" (point 8.1.3). An entity that decides such a test is not appropriate must document its reasoning in a comprehensible manner (Article 2(2)). The same text requires a simple mechanism for reporting suspicious events and regular staff training in how to use it (point 3.3).

The ENISA technical implementation guidance (June 2025, not binding) suggests testing that effectiveness, for example with quizzes or real scenarios. It does not list phishing simulations among the evidence: on this point the ILR templates are more explicit than EU guidance.

Banks, insurers and other financial entities: DORA applies

For financial entities, NIS 2 largely steps aside: Article 1(2) of DORA makes the regulation a sector-specific act for the purposes of Article 4 of the directive, and the Luxembourg law of 5 May 2026 then disapplies its relevant provisions, supervision and enforcement included (Article 1(8)). That equivalence test expressly covers only the Article 12 measures and incident reporting: whether Article 13 (training) is also displaced is a matter of interpretation, but DORA covers the same ground. The training duty therefore comes from DORA:

• Article 13(6): financial entities develop ICT security awareness programmes and digital operational resilience training "as compulsory modules in their staff training schemes", for all employees and senior management. ICT third-party service providers take part where appropriate, and their participation is a contract term (Article 30(2)(i)).
• Article 5: the management body allocates the budget for these programmes, and its members keep their knowledge up to date, "including by following specific training on a regular basis".
• Article 16: entities under the simplified framework develop these programmes according to their needs and ICT risk profile.

DORA never uses the words "phishing" or "social engineering". Its implementing standards do: as an attack technique to report in major-incident notifications ("social engineering, including phishing", data field 3.25 of Annex II to Implementing Regulation (EU) 2025/302), and in the technical standards on threat-led penetration testing (TLPT): red teams must master social engineering, and the test plan sets out "ethical boundaries for social engineering" (Annex IV of Delegated Regulation (EU) 2025/1190). Only designated entities have to carry out these tests, at least once every three years.

In Luxembourg, the law of 1 July 2024 designates the CSSF (financial sector supervisor) and the Commissariat aux assurances (insurance supervisor) as competent authorities, each for the entities it supervises; the ECB is the competent authority for significant credit institutions (Article 46 of DORA). For the entities they supervise, these two authorities can fine a breach of Article 13 of DORA up to 5 million euros or 10% of total annual turnover for a legal person, and up to 5 million euros for a natural person, members of the management body included (Article 20-24 of the amended law of 16 July 2019, inserted by the law of 1 July 2024).

Outside the DORA scope, that leaves CSSF Circular 20/750: since Circulars 25/881 and 26/915, it only covers support PFS and specialised PFS (two categories of professionals of the financial sector) and POST Luxembourg as a payment service provider. It expects training for all staff and contractors at least once a year (paragraph 49). Again, no mention of phishing.

The GDPR: no mandated training, but a duty to prove

The GDPR does not prescribe general staff training or a frequency for it. It does require, as appropriate, "a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures" (Article 32(1)(d)), and the ability to demonstrate compliance (Article 24). The CNPD, Luxembourg's data protection authority, can demand any information it needs and carry out audits (Article 58), and the data protection officer monitors staff awareness-raising and training (Article 39). A breach of Article 32 can cost up to 10 million euros or, for an undertaking, 2% of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83).

The European Data Protection Board recommends regular staff training on handling personal data breaches that reflects the latest attack trends (Guidelines 01/2021, paragraph 12). Its case no. 18 shows what a phishing email can cost: unable to establish how the attacker got in, the company supposed that an infected email had given access to the payments team's mailboxes; forwarding rules then exfiltrated the data of 99 employees, while a supplier bank-detail fraud was carried out. For the Board, all 99 employees should have been informed, not only the ten whose detailed salary data had leaked, partly because the data could be used for further attacks such as phishing.

In Luxembourg, the CNPD received 425 breach notifications in 2025. Malicious external acts account for 30%; by type of incident, hacking accounts for 24.9% and phishing for 3.1%. The regulator notes that a number of hacking and phishing attacks target senior management and those around them (assistants, management secretariat), often to obtain information for fraudulent financial transactions (2025 annual report).

Standards, auditors and insurers

• ISO/IEC 27001:2022: awareness (clause 7.3) is required for any certification, and Annex A control A.6.3 covers information security awareness, education and training. Neither names simulations.
• PCI DSS v4.0.1: since 31 March 2025, training must cover phishing and social engineering (requirement 12.6.3.1), on top of technical anti-phishing mechanisms (requirement 5.4.1). Periodic testing of reporting appears only in the guidance, which is not mandatory.
• NIST SP 800-50 Rev. 1 (September 2024, written for US federal agencies) lists phishing simulations among practical exercises and measures progress by the number of people who report the test email.
• Insurers: some cyber questionnaires ask whether the company runs simulations at least once a year, for example the one AIG Europe, a company incorporated under Luxembourg law, uses for the Dutch market (September 2023 version). A "no" is not presented there as excluding cover.

Phishing in 2026: what has changed

Phishing is no longer the main way in everywhere, but people remain at the heart of intrusions:

• in the Verizon DBIR 2026 (over 22,000 confirmed breaches), the human element is involved in 62% of breaches. As an initial access vector, vulnerability exploitation (31%) is ahead of phishing (16%); in Europe, the Middle East and Africa it is 47% against 28%, with a human element in 70% of cases;
• in Microsoft's incident response engagements (Digital Defense Report 2026), phishing rose from 7% to 23% of initial access, almost level with exploitation of public-facing applications (24%);
• according to ENISA (Threat Landscape 2026, 8,257 incidents analysed for 2025), phishing accounts for 77.8% of the social engineering techniques identified.

Ordinary MFA is no longer enough

Adversary-in-the-middle kits relay the real sign-in page and steal the session once authentication succeeds: an SMS code or push notification no longer protects. Tycoon2FA, the most widely observed kit in 2025 according to the vendor ANY.RUN (cited by ENISA), was used for emails reaching more than 500,000 organisations a month before its infrastructure was disrupted in March 2026, in an operation coordinated by Microsoft with Europol and partners; by June its activity was down 95% from its November 2025 peak. In Microsoft telemetry, this technique accounts for 44.6% of identified phishing techniques, and 87.7% of phishing intrusions involved credential or session harvesting. The answer is phishing-resistant authentication (FIDO2 keys, passkeys): see our analysis of phishing-resistant MFA under Article 32 of the GDPR and of the Tycoon 2FA kit.

Beyond email

• QR codes: Microsoft detected more than 145 million QR-code phishing attacks between July 2025 and June 2026. PDFs were the main carrier: their share reached 79% in April 2026, after four consecutive months of gains. The code moves the victim from a protected workstation to a phone.
• Calls and Teams: the weekly confirmed malicious volume of cross-organisation Teams vishing calls rose 502% in a year; the typical scenario starts with email bombing, then a fake IT help desk offers to help.
• Device code: the attacker gets the victim to enter a code on the real Microsoft sign-in page and collects the tokens. In February 2025 Microsoft reported device-code campaigns run since August 2024 by the group Storm-2372; in an update of 31 July 2026, it assesses Storm-2372 as an initial-access sub-cluster of Midnight Blizzard.
• Deepfakes: in Hong Kong in 2024, an employee made 15 transfers totalling 200 million Hong Kong dollars (about 25 million US dollars) after a faked video call; according to the police, the fraudster had downloaded videos in advance and added AI-generated voices. The press identified the company as Arup.

AI makes targeted phishing cheap

In an experiment with 101 participants (Heiding et al., Expert Systems with Applications, 2026), fully AI-generated spear phishing emails reached a 54% click-through rate, as high as those written by human experts, against 12% for generic emails. With about 7,700 participants, a study presented at USENIX Security 2026 (Czybik et al.) found that AI personalisation almost triples the click rate of a generic email (10.0% against 3.7 to 4.1%), for about three US cents per message; in that study, hand-written targeted emails still did better (24.2%, from only 99 emails). A simulation campaign limited to badly written generic emails measures yesterday's threat.

What research says about the effectiveness of simulations

Large field studies call for humility, and that is what makes it possible to design a useful campaign:

• Annual training alone does not show in the results. Across 19,789 employees of UC San Diego Health, eight monthly campaigns and ten lures, the date of the last annual training had no statistically significant link with failing a simulation (Ho et al., IEEE Symposium on Security and Privacy 2025).
• The "you've been phished" page teaches little. In the same study, training shown after the click reduced the failure rate by only 1.7 percentage points: the median session lasted from 0 to 10 seconds depending on the variant, and only 24% of sessions were completed. Across 14,733 employees followed for 15 months, this training, offered on a voluntary basis, did not even reduce clicks (Lain et al., IEEE S&P 2022).
• Over time, many people click. At UC San Diego Health, 56% of employees failed at least once in eight months, while only 9.7% failed in the first month. The failure rate ranged from 1.8% to 30.8% depending on the lure: a click rate means nothing without the difficulty of the email.
• Reporting does work. In Lain et al., employees kept reporting simulations without fatigue for 15 months; office staff who use a computer daily reported 22% of them (against 10% for infrequent users), and about 10% of reports arrived within five minutes, early enough to stop a real campaign. According to the Verizon DBIR 2025 (simulation data from more than 7,000 organisations, without causal analysis), employees trained within the last 30 days report about 21% of simulations, against 5% for those without recent training.
• Technical warnings matter. In Lain et al., a warning banner on suspicious emails cut clicks by almost a factor of three (3,964 clicks without a banner, 1,427 with a short one).

The practical conclusion: a phishing campaign is first a way to measure real exposure with emails of known difficulty, and to build the reporting reflex. It does not replace phishing-resistant MFA, filtering or email authentication (DMARC).

Running a lawful phishing campaign in Luxembourg

As far as we know, no Luxembourg authority has ruled on whether phishing simulations are lawful under the GDPR or labour law; the ILR only cites them as an example of evidence. What follows is our reading of the texts in force on 20 October 2026.

1. A GDPR legal basis, not consent

An employee's consent is rarely valid, because of the imbalance of power between employer and employee: for most processing at work, the European Data Protection Board considers that consent cannot and should not be the lawful basis (Guidelines 05/2020, paragraph 21). Two bases can be argued, and should be documented: the legal obligation to train staff (NIS 2, DORA) and to assess the effectiveness of measures (NIS 2), provided the simulation is necessary to comply, since no text names it; or the legitimate interest in securing the information system, which is not available to public authorities performing their tasks (Article 6). Data minimisation applies (Article 5).

2. Inform the staff delegation, and the employees

If the campaign records individual reactions (who clicked, who entered a password), the prudent approach is to treat it as processing for the purpose of monitoring employees under Article L. 261-1 of the Labour Code:

• the staff delegation (or, failing that, the Labour and Mines Inspectorate, ITM) and the employees concerned must be informed in advance;
• the notice states the purpose, the arrangements and the retention period, and contains a formal commitment not to use the data for any other purpose;
• within 15 days, the delegation (or failing that the employees) can ask the CNPD for a prior opinion; the CNPD has one month to respond and the request suspends the processing during that time, so allow up to 15 days plus one month, six to seven weeks, between notice and launch;
• processing in breach of these rules is a criminal offence (Article L. 261-2: eight days to one year of imprisonment and a fine of 251 to 125,000 euros, or one of these penalties only).

From 15 employees, the delegation gives its opinion on continuing vocational training plans (Article L. 414-3). In companies with at least 150 employees, Article L. 414-9 makes several matters subject to joint decision with the delegation, including technical installations intended to monitor employees' behaviour and performance, any collective continuing vocational training programme or action, and the general criteria for appraising employees. A campaign that tracks individual reactions, or that forms part of a collective training programme, may fall under points 1 and 4 of that article: in these companies, the prudent course is to decide it jointly with the delegation. One whose results fed into individual appraisals would also touch the appraisal criteria: one more reason never to use them that way.

3. An impact assessment if results have individual consequences

The CNPD list of processing operations that require an impact assessment (Article 35) includes regular and systematic monitoring of employee activities where it may produce legal effects for them or similarly significantly affect them. A campaign reported in aggregate, with no individual consequences, should not require one; named results used for disciplinary purposes very probably would.

4. Never punish, never keep passwords

The UK NCSC warns that "punishing people for clicking on emails you've sent starts to resemble entrapment"; it recommends consulting HR beforehand and measuring reports as well as clicks. NIST says these exercises should not be punitive and no employee should be called out.

French case law illustrates the point. In the Natixis case, the Paris Court of Appeal (30 October 2024) upheld the dismissal of an employee who had deliberately clicked on six test emails and typed insults as credentials, on top of two other faults: he was sanctioned not for failing the tests but for doing so on purpose. Because staff had been informed of the campaign, the entrapment argument failed. But the court held that the data had been collected in breach of the GDPR, and admitted it as evidence only because it was indispensable and proportionate. The Cour de cassation (24 June 2026) quashed the ruling only on the damages awarded, without revisiting that finding. The lesson: inform employees, and collect only the event ("credentials entered"), never the text typed.

5. Ethical lures

Fake emails promising a bonus have caused internal crises: at GoDaddy in December 2020 (a 650-dollar holiday bonus, about 500 employees caught and sent back to training, followed by an apology from the company), at Tribune Publishing in September 2020 (a bonus promised in the middle of pay cuts), and at West Midlands Trains, in a case made public in May 2021 (about 2,500 recipients). Rule out lures that play on pay, health or jobs, and do not imitate a real brand without taking precautions: NIST recommends involving the legal team in designing scenarios.

6. A narrow allowlist

For test emails to arrive, they must be declared to the mail system (in Microsoft 365, the "advanced delivery policy"). Declared messages then bypass spam and phishing filters: limit the declaration to the platform's domain and IP addresses, for the duration of the campaign. An overly broad allowlist is an open door for real attackers.

The method: a phishing simulation campaign in 10 steps

1. Scope: objectives, target population (executives and assistants included), legal basis, timetable, HR and security contacts.
2. Inform the staff delegation, then employees, that a simulation programme exists, without announcing dates.
3. Choose channels according to the real threat: email first and, depending on the case, SMS, a QR code in a PDF, a fake call or a Teams message from "IT support".
4. Calibrate difficulty: the number of visible cues and how well the pretext fits the teams' daily work, the two criteria of the NIST Phish Scale, which is free for academic use and needs a NIST licence for any commercial use. Vary the level from one campaign to the next.
5. Declare the campaign to the mail system and the SOC, narrowly and temporarily.
6. Provide a simple report button, linked to real analysis of reported messages, with feedback to the person who reported.
7. Measure events only: open, click, credentials entered (never the password typed), report.
8. Steer by the right indicators: report rate, time to first report, share of repeat clickers, always related to the difficulty of the lure.
9. Debrief collectively, without naming anyone. Keep individual follow-up voluntary: in a trial with 4,554 employees, making those who had failed twice take remedial training brought no significant benefit (Lain et al., ACM CCS 2024).
10. Repeat and keep the evidence: regular campaigns, new joiners included, reports archived for the ILR, the CSSF or the ISO 27001 auditor.

How Luxgap runs your phishing simulation campaign

Our phishing simulation campaign (page in French) is a turnkey email campaign in four steps (scoping, launch, tracking, debrief):

• one send of realistic email scenarios, calibrated to your sector and internal practices;
• up to 200 staff per campaign, set up in about 10 days; where Article L. 261-1 of the Labour Code applies, the launch waits until its time limit has run;
• real-time tracking of opens, clicks, credential submissions and reports;
• a PDF report you can share with your auditors, prioritised recommendations and an awareness debrief for your teams;
• data processed in Europe, and no campaign launched without your written agreement on the scope;
• 850 euros excluding VAT per campaign, no subscription.

For more than 200 staff, contact us for a tailored quote. To train your executives and teams, see our cyber awareness offer; for the GDPR side (legal basis, impact assessment, documentation), our DPO mandate.

Official sources and studies cited

• Law of 5 May 2026 (NIS 2), Mémorial A no. 225 and ILR, NIS 2 security measures and templates
• Implementing Regulation (EU) 2024/2690, Annex, points 3.3 and 8.1
• Law of 1 July 2024 (DORA), Mémorial A no. 271
• Labour Code, Articles L. 261-1, L. 261-2, L. 414-3 and L. 414-9
• CNPD, 2025 annual report; answer to parliamentary question no. 3691; NC3 observatory; Eurostat, isoc_cisce_ra
• ENISA Threat Landscape 2026; Verizon DBIR 2026; Microsoft Digital Defense Report 2026
• Ho et al., IEEE S&P 2025; Lain et al., IEEE S&P 2022
• NCSC, Phishing attacks: defending your organisation; NIST SP 800-50 Rev. 1

See also: Understanding NIS 2 · Understanding DORA · Understanding the GDPR · Order a phishing simulation campaign