German Federal Government Confirms Series of DDoS Cyberattacks on State Servers

Cyber & Information WarfareCyber AttacksAttacks on critical infrastructure (energy, transport, hospitals)

Aggressor

Summary

German federal government confirmed DDoS cyberattacks targeting ministries and authorities in May 2022, likely linked to Russia-Ukraine war; no damage or data leaks reported.

In early May 2022, German government websites of federal ministries and law enforcement agencies were targeted in Distributed Denial of Service (DDoS) cyberattacks, temporarily rendering sites unreachable but causing no reported damage or data loss. The attacks targeted critical sites including the Ministry of Defense, Bundestag, Federal Police, and Chancellor Olaf Scholz's SPD website. The Russian-affiliated hacker group "Killnet" claimed responsibility via Telegram, though official attribution remains pending. The Federal Criminal Police Office was also affected. Officials suspect these attacks are part of the cyber dimension of the ongoing Russia-Ukraine war, with pro-Russian hacker groups aiming to destabilize critical infrastructure such as energy, transport, communication, health sectors, and industrial supply chains. Authorities warn this hybrid conflict increasingly blurs lines between criminal and state-sponsored cyber actors.

Classification

Confidence: High

Classified as aggressor signal because the event describes hostile DDoS cyberattacks targeting German government infrastructure, claimed by a Russian hacker group. Classified as hybrid signal since it is a concrete cyber incident related to the Russia-Ukraine war with ongoing attribution uncertainty.

Source URL

https://tagesschau.de/inland/cyberattacke-bundesregierung-ddos-101.html

Open source

Provenance

Publisher: extension
Submitted: Apr 28, 2026, 14:51 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: May 9, 2022, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "33196b89-f459-4582-bb7c-37d7f62ef765",
  "url": "https://tagesschau.de/inland/cyberattacke-bundesregierung-ddos-101.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
  "country": "Germany",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "DDoS attack",
    "Russian hacker group",
    "Killnet",
    "cyberattacks",
    "Germany",
    "Federal government",
    "russia–ukraine war",
    "Critical infrastructure",
    "Hybrid warfare"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": "German Federal Government Confirms Series of DDoS Cyberattacks on State Servers",
  "description": "In early May 2022, the German federal government confirmed a series of Distributed Denial of Service (DDoS) cyberattacks targeting websites of German federal ministries and authorities, including the Ministry of Defense, Bundestag, Federal Police, several state police authorities, and the SPD website of Chancellor Olaf Scholz. Although the cyberattacks rendered these sites temporarily inaccessible, no damage or data leaks were reported. A Russian-linked hacker group known as \"Killnet\" claimed responsibility via Telegram, but attribution remains unconfirmed. The Federal Criminal Police Office (BKA) and other authorities were also affected. The attacks are believed to be linked to the ongoing Russia-Ukraine war, with pro-Russian hacker groups aiming for destabilization. Experts warn of potential sabotage threats against critical infrastructure sectors such as energy, transport, communication, health, and industry supply chains, emphasizing the hybrid nature of the conflict which increasingly involves cyber operations.",
  "summary_short": "German federal government confirmed DDoS cyberattacks targeting ministries and authorities in May 2022, likely linked to Russia-Ukraine war; no damage or data leaks reported.",
  "summary_extended": "In early May 2022, German government websites of federal ministries and law enforcement agencies were targeted in Distributed Denial of Service (DDoS) cyberattacks, temporarily rendering sites unreachable but causing no reported damage or data loss. The attacks targeted critical sites including the Ministry of Defense, Bundestag, Federal Police, and Chancellor Olaf Scholz's SPD website. The Russian-affiliated hacker group \"Killnet\" claimed responsibility via Telegram, though official attribution remains pending. The Federal Criminal Police Office was also affected. Officials suspect these attacks are part of the cyber dimension of the ongoing Russia-Ukraine war, with pro-Russian hacker groups aiming to destabilize critical infrastructure such as energy, transport, communication, health sectors, and industrial supply chains. Authorities warn this hybrid conflict increasingly blurs lines between criminal and state-sponsored cyber actors.",
  "actor_primary": "Killnet",
  "target_primary": null,
  "location_text": "German federal ministries and authorities",
  "location_region": null,
  "location_coordinates_lat": 51.1657,
  "location_coordinates_lon": 10.4515,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "Classified as aggressor signal because the event describes hostile DDoS cyberattacks targeting German government infrastructure, claimed by a Russian hacker group. Classified as hybrid signal since it is a concrete cyber incident related to the Russia-Ukraine war with ongoing attribution uncertainty.",
  "event_time_utc": "2022-05-09T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T14:51:00.378Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "medium",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: MediumSingle sourceTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

May 9, 2022, 00:00 UTC

Event time confidence

pm24h

Location

German federal ministries and authorities

Primary actor

Killnet

Country

Germany

Countries

Germany

Tags

DDoS attack, Russian hacker group, Killnet, cyberattacks, Germany, Federal government, russia–ukraine war, Critical infrastructure, Hybrid warfare

Nodes

Node 1: Borders, Node 2: 5th Column

Loading signal...

{ "id": "33196b89-f459-4582-bb7c-37d7f62ef765", "url": "https://tagesschau.de/inland/cyberattacke-bundesregierung-ddos-101.html", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)", "country": "Germany", "source_reliability": "B", "info_credibility": "3", "tags": [ "DDoS attack", "Russian hacker group", "Killnet", "cyberattacks", "Germany", "Federal government", "russia–ukraine war", "Critical infrastructure", "Hybrid warfare" ], "nodes": [ "Node 1: Borders", "Node 2: 5th Column" ], "countries": [ "Germany" ], "where_text": "Cyberspace", "headline": "German Federal Government Confirms Series of DDoS Cyberattacks on State Servers", "description": "In early May 2022, the German federal government confirmed a series of Distributed Denial of Service (DDoS) cyberattacks targeting websites of German federal ministries and authorities, including the Ministry of Defense, Bundestag, Federal Police, several state police authorities, and the SPD website of Chancellor Olaf Scholz. Although the cyberattacks rendered these sites temporarily inaccessible, no damage or data leaks were reported. A Russian-linked hacker group known as \"Killnet\" claimed responsibility via Telegram, but attribution remains unconfirmed. The Federal Criminal Police Office (BKA) and other authorities were also affected. The attacks are believed to be linked to the ongoing Russia-Ukraine war, with pro-Russian hacker groups aiming for destabilization. Experts warn of potential sabotage threats against critical infrastructure sectors such as energy, transport, communication, health, and industry supply chains, emphasizing the hybrid nature of the conflict which increasingly involves cyber operations.", "summary_short": "German federal government confirmed DDoS cyberattacks targeting ministries and authorities in May 2022, likely linked to Russia-Ukraine war; no damage or data leaks reported.", "summary_extended": "In early May 2022, German government websites of federal ministries and law enforcement agencies were targeted in Distributed Denial of Service (DDoS) cyberattacks, temporarily rendering sites unreachable but causing no reported damage or data loss. The attacks targeted critical sites including the Ministry of Defense, Bundestag, Federal Police, and Chancellor Olaf Scholz's SPD website. The Russian-affiliated hacker group \"Killnet\" claimed responsibility via Telegram, though official attribution remains pending. The Federal Criminal Police Office was also affected. Officials suspect these attacks are part of the cyber dimension of the ongoing Russia-Ukraine war, with pro-Russian hacker groups aiming to destabilize critical infrastructure such as energy, transport, communication, health sectors, and industrial supply chains. Authorities warn this hybrid conflict increasingly blurs lines between criminal and state-sponsored cyber actors.", "actor_primary": "Killnet", "target_primary": null, "location_text": "German federal ministries and authorities", "location_region": null, "location_coordinates_lat": 51.1657, "location_coordinates_lon": 10.4515, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "Classified as aggressor signal because the event describes hostile DDoS cyberattacks targeting German government infrastructure, claimed by a Russian hacker group. Classified as hybrid signal since it is a concrete cyber incident related to the Russia-Ukraine war with ongoing attribution uncertainty.", "event_time_utc": "2022-05-09T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-04-28T14:51:00.378Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "medium", "attribution_basis": "single_source" }