Germany Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Germany
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for Germany, checked 7 Nov 2026. The BSI publishes no standing national cyber threat level; it rates each cyber security warning by criticality and describes the overall picture in its annual Lagebericht.
Source: BSI
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
| Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Germans who were cybercrime victims | 1 in 10 | Past year (Cybersicherheitsmonitor 2026) | Euro Security (BSI) |
| Organisations BSI expects to supervise under NIS2 | About 29,500 | From NIS2 law, passed November 2025 | Euro Security (BSI) |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| Qilin | Ransomware | Claimed the March 2026 attack on Die Linke; Germany arrested a suspected core member in October 2026. | BleepingComputer | Profile |
| Rhysida | Ransomware | Claimed the August 2026 data theft from Berlin's city administration. | BleepingComputer | Profile |
Laws and rules this year
- 11 Sep 2026EU Cyber Resilience Act reporting obligations apply. Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents from this date; the main obligations follow on 11 December 2027. Source
Full stories
- European supermarket fridges hacked in a single night Estonia, United Kingdom, Germany +5 · 3 Nov 2026
Official statements
- 22 Oct 2026BSI issued a warning on critical PHP vulnerabilities rated at its highest criticality, 3 (very high). BSI
- 15 May 2026BSI's Cybersicherheitsmonitor 2026 found one in ten Germans fell victim to cybercrime in the past year. Euro Security
- 6 Feb 2026Germany's domestic intelligence agency warned of suspected state-sponsored Signal account hijacking aimed at senior figures. BleepingComputer
Incidents
4 of 4 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
| ✅ ConfirmedSupermarkets including Edeka and CAP MarketsVia a vendorFull story | 2 Nov 2026 | Retail | Not disclosed | None | Confirmed. Officials and company representatives confirmed four German supermarket outlets were hit in the 2 November refrigeration attack wave. | The Local (AFP) · Wikipedia✓ 7 Nov |
 ✅ ConfirmedFlink | 25 Sep 2026 | Retail | Data leak | Confirmed. Flink confirmed unauthorised access to an internal system holding customer contact data and reported it to the German data protection authority and police. Claimed. LPG Group claimed data on one million customers and 13,000 workers and sent ransom notes to individuals. | NL Times✓ 7 Nov | |
 ✅ ConfirmedBerlin Senate administration | 14 Aug 2026 | Government | Ransomware | Confirmed. Berlin confirmed extortion attempts after data theft, disconnected affected Senate departments on 14 August, and the mayor said the city will not pay. Claimed. Rhysida claimed 5.79 TB of administrative files, including HR, financial and water-supply security documents. | BleepingComputer✓ 7 Nov | |
 ✅ ConfirmedDie Linke | 27 Mar 2026 | Other | Ransomware | Confirmed. The party disclosed a cyber incident, said attackers aimed to publish internal data and staff details, and filed a criminal complaint. Claimed. Qilin listed Die Linke on its leak site on 1 April 2026. | BleepingComputer✓ 7 Nov |
FAQ
Does Germany have a national cyber threat level?
No published national cyber threat level was found for Germany (checked 7 Nov 2026). The BSI publishes no standing national cyber threat level; it rates each cyber security warning by criticality and describes the overall picture in its annual Lagebericht.
Which organisations in Germany confirmed cyber incidents recently?
4 incidents confirmed since January 2026: Supermarkets including Edeka and CAP Markets, Flink, Berlin Senate administration and Die Linke.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.