Germany — Cyber Threat Profile
Germany's 2026 environment is dominated by the full implementation of the NIS2 Directive and the KRITIS-DachG (Critical Infrastructure Framework Act). The BSI (Federal Office for Information Security) has mandated that all essential entities register by March 2026, introducing strict governance and supply-chain oversight. Geopolitical tensions have driven a significant surge in cyber-defense spending, with a focus on Zero Trust architectures. The Federal Network Agency (BNetzA) is also overhauling security requirements for telecommunications and 5G spectrum allocation. Germany remains a primary target for ransomware, necessitating a shift toward AI-driven automated defense and hardened sovereign cloud infrastructure for public services.- National CERT/CSIRT: CERT-Bund
- Data protection authority: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) (source: CNIL)
- World Cybercrime Index 2024 (origin significance): 2.17 / 100, #18 worldwide
- Secure Internet servers per 1M people (2024): 152,113.8 (source: World Bank)
- Internet users (2024): 93.5% of population (source: World Bank)
Latest Germany coverage
- New ransomware crew Za Woo opens with 10 German victims 2026-08-30 · Ransomware
- SafePay ransomware names a German airport and charity in leak site surge 2026-07-06 · Ransomware
Threat actors targeting Germany
- APT27 APT
- APT28 APT
- FrostyNeighbor APT
- Kimsuky APT
- NoName057(16) Hacktivist
- Ruza Flood APT
- SafePay Ransomware · 122 incident(s)
- Qilin Ransomware · 85 incident(s)
- Akira Ransomware · 69 incident(s)
- LockBit Ransomware · 51 incident(s)
- INC Ransom Ransomware · 38 incident(s)
- DragonForce Ransomware · 32 incident(s)
- The Gentlemen Ransomware · 27 incident(s)
- RansomHub Ransomware · 22 incident(s)
- Play Ransomware Ransomware · 20 incident(s)
- Lynx Ransomware Ransomware · 16 incident(s)
- Black Basta Ransomware · 15 incident(s)
- Fog Ransomware Ransomware · 15 incident(s)
- Cl0p Ransomware · 13 incident(s)
- 8Base Ransomware · 12 incident(s)
- Sarcoma Ransomware · 12 incident(s)
- Za Woo Ransomware · 11 incident(s)
- Krybit Ransomware · 10 incident(s)
- Aurora Ransomware · 7 incident(s)
- Hunters International Ransomware · 7 incident(s)
- Rhysida Ransomware · 7 incident(s)
- Settra Ransomware · 7 incident(s)
- Payload Ransomware · 6 incident(s)
- Coinbase Cartel Ransomware · 5 incident(s)
- Medusa Ransomware Ransomware · 5 incident(s)
- NightSpire Ransomware · 5 incident(s)
- Stormous Hacktivist · 5 incident(s)
- Everest Ransomware · 4 incident(s)
- M3rx Ransomware · 4 incident(s)
- MedusaLocker Ransomware · 4 incident(s)
- RansomHouse Ransomware · 4 incident(s)
- ShinyHunters Ransomware · 4 incident(s)
- Space Bears Ransomware · 4 incident(s)
- 3AM Ransomware · 3 incident(s)
- BlackSuit Ransomware · 3 incident(s)
Most targeted sectors
- Manufacturing 187 incident(s)
- Technology 116 incident(s)
- Business & Professional Services 101 incident(s)
- Retail & Consumer 47 incident(s)
- Healthcare 39 incident(s)
- Construction 31 incident(s)
- Transportation & Logistics 31 incident(s)
- Agriculture & Food 23 incident(s)
- Education & Research 20 incident(s)
- Energy & Utilities 18 incident(s)
- Government & Public Sector 17 incident(s)
- Legal 13 incident(s)
Recent claimed incidents
- KÖRBER 2026-09-07 · Manufacturing
- Metro 2026-09-07 · Retail & E-Commerce
- Hochschule Heilbronn Bildungscampus 2026-09-04 · Education
- Stransky Heiz-Mess-Regeltechnik GmbH 2026-09-04 · Manufacturing
- KALA Health 2026-09-04 · Healthcare
- hansler.com 2026-09-03 · Retail & E-Commerce
- A...en 2026-09-03
- DMT Consulting Private Limited 2026-09-01 · Technology
- Meteor Group 2026-08-31 · Other
- transcar.com 2026-08-31 · Transportation
- KFZ-MEISTERBETRIEB JOST GmbH 2026-08-31 · Transportation
- fes-sport.de 2026-08-31 · Retail & E-Commerce
- crmeyer.com 2026-08-31 · Professional Services
- fessport 2026-08-30
- vectorsoft.de 2026-08-30 · Technology