Germany — Cyber Threat Profile
Germany's 2026 environment is dominated by the full implementation of the NIS2 Directive and the KRITIS-DachG (Critical Infrastructure Framework Act). The BSI (Federal Office for Information Security) has mandated that all essential entities register by March 2026, introducing strict governance and supply-chain oversight. Geopolitical tensions have driven a significant surge in cyber-defense spending, with a focus on Zero Trust architectures. The Federal Network Agency (BNetzA) is also overhauling security requirements for telecommunications and 5G spectrum allocation. Germany remains a primary target for ransomware, necessitating a shift toward AI-driven automated defense and hardened sovereign cloud infrastructure for public services.- National CERT/CSIRT: CERT-Bund
- Data protection authority: Der Bundesbeauftragte für den Datenschutz und die Informations freiheit 153 Graurheindorfer Straße, 53117, Bonn, (source: CNIL)
- World Cybercrime Index 2024 (origin significance): 2.17 / 100, #18 worldwide
- Secure Internet servers per 1M people (2024): 152,113.8 (source: World Bank)
- Internet users (2024): 93.5% of population (source: World Bank)
Latest Germany coverage
- SafePay ransomware names a German airport and charity in leak site surge 2026-07-06 · Ransomware
Threat actors targeting Germany
- APT27 APT
- APT28 APT
- FrostyNeighbor APT
- Kimsuky APT
- NoName057(16) Hacktivist
- Ruza Flood APT
- SafePay Ransomware · 122 incident(s)
- Qilin Ransomware · 76 incident(s)
- Akira Ransomware · 66 incident(s)
- LockBit Ransomware · 48 incident(s)
- INC Ransom Ransomware · 37 incident(s)
- DragonForce Ransomware · 32 incident(s)
- The Gentlemen Ransomware · 29 incident(s)
- RansomHub Ransomware · 23 incident(s)
- Play Ransomware Ransomware · 19 incident(s)
- Lynx Ransomware Ransomware · 17 incident(s)
- Black Basta Ransomware · 15 incident(s)
- Fog Ransomware Ransomware · 15 incident(s)
- Cl0p Ransomware · 13 incident(s)
- Sarcoma Ransomware · 12 incident(s)
- 8Base Ransomware · 11 incident(s)
- Krybit Ransomware · 8 incident(s)
- Hunters International Ransomware · 7 incident(s)
- Aurora Ransomware · 6 incident(s)
- Payload Ransomware · 6 incident(s)
- Medusa Ransomware Ransomware · 5 incident(s)
- NightSpire Ransomware · 5 incident(s)
- Rhysida Ransomware · 5 incident(s)
- Settra Ransomware · 5 incident(s)
- Stormous Hacktivist · 5 incident(s)
- APT73 Ransomware · 4 incident(s)
- Coinbase Cartel Ransomware · 4 incident(s)
- Deadlock Ransomware · 4 incident(s)
- M3rx Ransomware · 4 incident(s)
- MedusaLocker Ransomware · 4 incident(s)
- RansomHouse Ransomware · 4 incident(s)
- ShinyHunters Ransomware · 4 incident(s)
- 3AM Ransomware · 3 incident(s)
- BlackSuit Ransomware · 3 incident(s)
- Chaos Ransomware · 3 incident(s)
Most targeted sectors
- Manufacturing 147 incident(s)
- Technology 102 incident(s)
- Business & Professional Services 78 incident(s)
- Retail & Consumer 28 incident(s)
- Healthcare 26 incident(s)
- Transportation & Logistics 24 incident(s)
- Agriculture & Food 19 incident(s)
- Energy & Utilities 16 incident(s)
- Construction 12 incident(s)
- Financial Services 12 incident(s)
- Government & Public Sector 11 incident(s)
- Hospitality & Tourism 11 incident(s)
Recent claimed incidents
- BMW Group 2026-08-17 · Manufacturing
- Botek 2026-08-16 · Manufacturing
- DELTA WAYS 2026-08-16 · Transportation
- motorenmaier gmbh 2026-08-16 · Manufacturing
- tiltstudio.com 2026-08-16 · Technology
- Idex Group 2026-08-16 · Technology
- TECOSIM 2026-08-16 · Technology
- Verbandsgemeinde Rhein-Nahe 2026-08-16 · Energy & Utilities
- INVENSITY 2026-08-16 · Technology
- Alpine Electronics Europe 2026-08-15 · Manufacturing
- Tempel 2026-08-14 · Other
- Reminger 2026-08-13 · Professional Services
- BerlinerLuft. Technology GmbH 2026-08-12 · Technology
- SCHMITZ & NITTENWILM 2026-08-12 · Manufacturing
- B&B Hydraulik 2026-08-11 · Manufacturing