Loading story…
A Bitkom survey of 1,003 German companies found that nearly 40% of organizations affected by data theft, industrial espionage, or sabotage attributed at least one incident to a foreign intelligence service, up from 28% a year earlier and 7% in 2023. China was the most frequently cited source, followed by Russia; roughly one in 10 affected firms linked incidents to Iran. Ransomware remained the most commonly reported attack type, while estimated annual losses from cyberattacks remained in the hundreds of billions of euros.
Federal Office for the Protection of the Constitution President Sinan Selen warned that AI is worsening the threat environment, citing a China-linked operation assessed as entirely AI-generated. He urged stronger patching, resilience, and preventive cooperation, and said expanded intelligence powers would not create a systemic risk of zero-day vulnerabilities being withheld from Germany’s Federal Office for Information Security. Survey respondents also reported an increase in ransomware payments.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Nearly four in 10 affected companies attributed at least one incident involving data theft, industrial espionage, or sabotage to a foreign intelligence service, compared with 28% in the prior-year survey. China was the most frequently cited foreign source, followed by Russia and Iran.
Bitkom surveyed 1,003 German companies with more than 10 employees and estimated directly quantifiable cyberattack damage at €211 billion to €270.8 billion. The survey found ransomware remained a dominant threat, with 20% of respondents reporting that they had paid a ransom at least once.
Bitkom reported that 7% of affected German companies attributed at least one cyber incident to a foreign intelligence service in 2023.
Selen said proposed expanded intelligence authorities should support intervention against attacks and attacker infrastructure, but rejected claims that the BfV would systematically withhold vulnerabilities from the BSI. He stated that protecting society and the economy is incompatible with knowingly leaving vulnerabilities unaddressed.
BfV President Sinan Selen said the agency had identified an attack campaign from China that was entirely AI-generated. He warned that AI, deepfakes, and robocalls are accelerating the cyber threat environment and called for faster patching and multilayered defenses.
Lidl disclosed a data breach after attackers accessed customer information held by one of its IT service providers.
Hackers targeted Unimed, an external billing provider used by medical centers across Germany. Several German university hospitals said patient information was stolen in the breach.
The Dresden State Art Collections suffered a targeted cyberattack that disrupted substantial portions of its digital infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German lawmakers are advancing draft legislation to significantly expand the Bundesnachrichtendienst’s (**BND**) hacking and surveillance authorities, including intercepting full internet communications (not just metadata), retaining collected data for up to six months, and extending the agency’s offensive mandate to hack foreign internet service providers to obtain target information when companies do not cooperate. Reporting indicates the proposal is partly aimed at reducing reliance on the US **NSA** for threat intelligence and bringing Germany’s capabilities in line with other European services; it would also broaden who can be surveilled, including foreigners inside Germany and certain journalists tied to foreign state-run media, and would enable intrusive operations such as deploying a “federal trojan.” Separately, Ukrainian and German law enforcement reported disrupting a Russian-affiliated ransomware operation, identifying and searching two suspects in Ukraine alleged to have served as “hash cracker” specialists who extracted/cracked password hashes, used stolen credentials for lateral movement and privilege escalation, and supported ransomware deployment and data exfiltration for extortion. Authorities seized digital devices and cryptocurrency assets and said an alleged Russian organizer has been identified, with foreign partners suggesting possible links to the **Conti** ransomware ecosystem. A third item—a *Citizen Lab* job posting—does not report a specific incident and is primarily recruitment content, despite referencing prior research on targeted phishing and spyware threats.
Jul 2, 2026
Germany’s federal government signaled a shift toward a more **offensive posture** in response to cyberattacks. Interior Minister **Alexander Dobrindt** said Germany intends to “strike back,” including actions abroad to disrupt attackers and destroy their infrastructure, with operations to be carried out jointly by intelligence services and the **Bundeskriminalamt (BKA)**. The Interior Ministry also plans a new defense center for **hybrid threats**, prepared by the domestic intelligence service, to improve coordination across government levels; Dobrindt framed the move as a response to persistent attacks on institutions, critical infrastructure, and companies, often attributed to groups linked to state services (including Russia). Separately, the **Staatliche Kunstsammlungen Dresden** (a network of 15 museums) reported continued operational impacts from a **cyberattack**, with museums remaining open but key services still impaired, including `online ticketing`, card payments on-site, the online shop, and visitor services. Police and the state criminal office initiated investigations, and the Dresden public prosecutor indicated the case may be handled by Saxony’s specialized cybercrime unit (ZCS). The UK government’s discussion of building a **digital ID** system in-house is policy/technology governance reporting and does not describe a specific cyber incident or vulnerability tied to the German developments.
Jul 12, 2026
European organizations are experiencing a significant increase in ransomware and extortion attacks, with threat actors leveraging artificial intelligence to accelerate and enhance their operations. According to CrowdStrike’s 2025 European Threat Landscape Report, Europe now accounts for nearly 22% of global ransomware and extortion victims, making it the second most targeted region after North America. AI is enabling adversaries to breach networks and deploy ransomware more quickly, with groups like SCATTERED SPIDER reducing their attack cycle to approximately 24 hours. The most targeted countries include the United Kingdom, Germany, France, Italy, and Spain, and affected sectors span manufacturing, professional services, technology, and retail. Attackers are also employing advanced social engineering tactics, such as fake CAPTCHA lures, to compromise victims. The report also highlights a rise in hacktivism and nation-state cyber operations, particularly from Russian and North Korean actors, amid ongoing geopolitical tensions. Russian threat actors have shifted focus toward Ukraine and related regions since the 2022 invasion, while North Korea is reportedly supporting Russian operations and targeting Ukraine. The European threat landscape is described as increasingly complex, with eCrime, espionage, and disruptive attacks posing significant risks to both public and private sector organizations. Security teams are urged to adapt to the evolving threat environment, where AI-driven automation and deception are reshaping the speed and scale of cyberattacks.
Jun 29, 2026