Germany — Cyber Threat Profile
Germany's 2026 environment is dominated by the full implementation of the NIS2 Directive and the KRITIS-DachG (Critical Infrastructure Framework Act). The BSI (Federal Office for Information Security) has mandated that all essential entities register by March 2026, introducing strict governance and supply-chain oversight. Geopolitical tensions have driven a significant surge in cyber-defense spending, with a focus on Zero Trust architectures. The Federal Network Agency (BNetzA) is also overhauling security requirements for telecommunications and 5G spectrum allocation. Germany remains a primary target for ransomware, necessitating a shift toward AI-driven automated defense and hardened sovereign cloud infrastructure for public services.- National CERT/CSIRT: CERT-Bund
- Data protection authority: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) (source: CNIL)
- World Cybercrime Index 2024 (origin significance): 2.17 / 100, #18 worldwide
- Secure Internet servers per 1M people (2024): 152,113.8 (source: World Bank)
- Internet users (2024): 93.5% of population (source: World Bank)
Latest Germany coverage
- New ransomware crew Za Woo opens with 10 German victims 2026-08-30 · Ransomware
- SafePay ransomware names a German airport and charity in leak site surge 2026-07-06 · Ransomware
Threat actors targeting Germany
- APT27 APT
- APT28 APT
- FrostyNeighbor APT
- Kimsuky APT
- NoName057(16) Hacktivist
- Ruza Flood APT
- SafePay Ransomware · 129 incident(s)
- Qilin Ransomware · 90 incident(s)
- Akira Ransomware · 71 incident(s)
- LockBit Ransomware · 54 incident(s)
- INC Ransom Ransomware · 42 incident(s)
- DragonForce Ransomware · 32 incident(s)
- The Gentlemen Ransomware · 32 incident(s)
- Play Ransomware Ransomware · 23 incident(s)
- RansomHub Ransomware · 22 incident(s)
- Lynx Ransomware Ransomware · 16 incident(s)
- Black Basta Ransomware · 15 incident(s)
- Fog Ransomware Ransomware · 15 incident(s)
- Lamashtu Ransomware · 14 incident(s)
- Cl0p Ransomware · 13 incident(s)
- 8Base Ransomware · 12 incident(s)
- Sarcoma Ransomware · 12 incident(s)
- Krybit Ransomware · 11 incident(s)
- Za Woo Ransomware · 11 incident(s)
- Rhysida Ransomware · 10 incident(s)
- Aurora Ransomware · 8 incident(s)
- Settra Ransomware · 8 incident(s)
- Hunters International Ransomware · 7 incident(s)
- Payload Ransomware · 7 incident(s)
- NightSpire Ransomware · 6 incident(s)
- Coinbase Cartel Ransomware · 5 incident(s)
- Everest Ransomware · 5 incident(s)
- Medusa Ransomware Ransomware · 5 incident(s)
- ShinyHunters Ransomware · 5 incident(s)
- Stormous Hacktivist · 5 incident(s)
- 3AM Ransomware · 4 incident(s)
- Anubis Ransomware · 4 incident(s)
- M3rx Ransomware · 4 incident(s)
- MedusaLocker Ransomware · 4 incident(s)
- Panzer Ransomware · 4 incident(s)
Most targeted sectors
- Manufacturing 204 incident(s)
- Technology 122 incident(s)
- Business & Professional Services 112 incident(s)
- Retail & Consumer 47 incident(s)
- Healthcare 45 incident(s)
- Transportation & Logistics 34 incident(s)
- Construction 31 incident(s)
- Agriculture & Food 24 incident(s)
- Education & Research 23 incident(s)
- Energy & Utilities 19 incident(s)
- Government & Public Sector 17 incident(s)
- Hospitality & Tourism 13 incident(s)
Recent claimed incidents
- SCHWAB-SYSTEM 2026-10-23 · Financial Services
- von Schaewen 2026-10-23 · Other
- Hensel Elektrik 2026-10-23 · Manufacturing
- Gräfliches Hofbrauhaus Freising 2026-10-22 · Agriculture and Food Production
- VERGI Muenster 2026-10-22 · Energy & Utilities
- Hecker Holzsystembau 2026-10-22 · Manufacturing
- Medienwerkstatt 2026-10-22 · Education
- DR.SCHNELL GmbH & Co. KGaA 2026-10-22 · Manufacturing
- Lindauer Dornier 2026-10-21 · Manufacturing
- FuG-Gruppe 2026-10-21 · Other
- WEPOS Chemie 2026-10-21 · Manufacturing
- Brüninghoff Group 2026-10-20 · Manufacturing
- Seetelhotels.de 2026-10-19 · Hospitality
- Pergande 2026-10-18
- Minkon 2026-10-16