In the EU, electronic communication providers notify significant security incidents to the National regulatory authority (NRA) in their country. At the start of every calendar year the NRAs send a summary about these incidents to ENISA. This document covers the incidents reported by NRAs for 2018 and gives an anonymised, aggregated EU-wide overview of telecom security incidents. Security breach reporting has been part of the EU’s telecom regulatory framework since the 2009 reform of the telecom package: Article 13a of the Framework directive (2009/140/EC) came into force in 2011. The breach reporting in Article 13a focuses on security incidents with significant impact on the operation of services, i.e. outages of the electronic communication networks and/or services.