Over 40,000 firms, including energy providers, banks and hospitals could be required to report cyber-break-ins under new rules proposed by the EU.
It is part of a move to intensify global efforts to fight cybercrime.
Digital agenda commissioner Neelie Kroes said that Europe needed to improve how it dealt with cybersecurity.
But firms are concerned that reporting online attacks and security breaches might damage their reputations.
The EU is keen that member states share information about attacks and shore up their cyber-defences.
Under the proposals, each country would have to appoint a Computer Emergency Response Team and create an authority to whom companies would report breaches.
These new bodies would decide whether to make the breaches public and whether to fine companies.
Announcing the changes, Neelie Kroes said: “Europe needs resilient networks and systems and failing to act would impose significant costs on consumers, businesses and society.”
According to the EU, only one in four European companies has a regularly-reviewed, formal ICT security policy. Even among ICT companies, the figure is only one in two, it said.
