Western capitals accuse Russia of being behind the attempt to hack into the network of the Organisation for the Prohibition of Chemical Weapons (OPCW) in The Hague.
It had been investigating the poisoning of former Russian double agent Sergei Skripal in Britain, as well as the alleged use of chemical weapons by the Syrian government.
Under the new legal framework, the EU can sanction people or entities “that are responsible for cyberattacks or attempted cyberattacks, who provide financial, technical or material support for such attacks or who are involved in other ways,” the bloc said in a statement.
The measures – which include an EU entry ban and asset freeze – can also be applied to associated people or entities.
Anyone on the sanctions list is unable to receive funds from within the EU.
British Foreign Secretary, Jeremy Hunt, welcomed Friday’s “decisive action.”
“For too long now, hostile actors have been threatening the EU’s security through disrupting critical infrastructure, attempts to undermine democracy and stealing commercial secrets and money running to billions of euros,” he said.
Brussels had begun ratcheting up its response to malicious cyberactivities months before it emerged in October that the Netherlands had expelled Russian spies due to the attempted cyberattack on the OPCW.