Cybercrime Hits Record High in Germany in 2019, BKA Warns of Rising Ransomware Attacks

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

In 2019, cyberattacks in Germany reached a record high with over 100,000 incidents, mainly targeting companies and public institutions, according to BKA. The COVID-19 pandemic was exploited by criminals via fake government websites and emails.

The number of cyberattacks reported in Germany rose by more than 15% in 2019 compared to the previous year, reaching a total of 100,514 incidents, as reported by the Federal Criminal Police Office (BKA). Main targets were companies and public institutions, selected for their high potential criminal profits. The primary threat remains attacks using ransomware, which encrypts data and demands payment in cryptocurrency, mostly Bitcoin, for decryption. Attackers often also steal confidential data and threaten to publish it. During the COVID-19 pandemic (March to August 2020), cybercriminals leveraged the crisis by cloning government websites related to corona financial aid and sending fake emails supposedly from authorities or banks to spread malware. The BKA highlighted the international, highly professional network of cybercriminals, who can swiftly adapt to new opportunities like the pandemic. In 2019, 22,574 suspects in cybercrime were investigated, a 2% increase from 2018. The financial damage to the German economy is estimated at over 100 billion euros, according to the industry association Bitkom cited by BKA. The BKA advised companies and citizens to utilize current virus protection, strong passwords, and regular backups, and to be skeptical of emails from unknown senders. The DPolG police union called for more IT experts in security agencies and easing the entry of career changers to police services, with calls for legislative changes to allow police to monitor messenger communications more effectively.

Classification

Confidence: High

The article reports a concrete increase in cyberattacks in Germany in 2019 attributed to criminal actors using ransomware and malware, indicating ongoing hostile cyber activity. The BKA explicitly links these activities to a professional, international criminal network. The pandemic-related exploitation is detailed with specific tactics such as fake government websites and emails. No indication of defensive-only content justifies HYBRID_SIGNAL with aggressor set true.

Source URL

https://tagesschau.de/inland/cyberangriffe-bka-101.html

Open source

Provenance

Publisher: extension
Submitted: Apr 28, 2026, 13:45 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Dec 31, 2019, 23:59 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "b7afbc2d-3c62-400e-a4d2-c3045dc0c20a",
  "url": "https://tagesschau.de/inland/cyberangriffe-bka-101.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Germany",
  "source_reliability": "A",
  "info_credibility": "3",
  "tags": [
    "Cybercrime",
    "Ransomware",
    "Malware",
    "BKA",
    "Germany",
    "COVID-19 exploitation",
    "Data theft"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": "Cybercrime Hits Record High in Germany in 2019, BKA Warns of Rising Ransomware Attacks",
  "description": "In 2019, Germany experienced a record number of cyberattacks, with over 100,000 incidents, marking a rise of more than 15% from the previous year, according to the Federal Criminal Police Office (BKA). Companies and public institutions were the main targets due to the high criminal profits possible. Ransomware, which encrypts victims' data and demands Bitcoin payments for decryption, remains the largest threat, often combined with data theft and extortion. During the COVID-19 pandemic, criminals exploited the crisis by cloning government financial aid websites and sending fake emails from authorities to spread malware. Cybercriminal networks are international and highly professional, demonstrating flexibility in adapting to new opportunities. In 2019, German police investigated over 22,500 cybercrime suspects, a 2% increase from 2018. The financial impact on the German economy is estimated at over 100 billion euros. The BKA urged increased preventive measures including updated virus protection, strong passwords, regular data backups, and caution regarding unknown emails. The police union DPolG demanded more IT specialists in security agencies and legislative reforms permitting police surveillance of messenger communications.",
  "summary_short": "In 2019, cyberattacks in Germany reached a record high with over 100,000 incidents, mainly targeting companies and public institutions, according to BKA. The COVID-19 pandemic was exploited by criminals via fake government websites and emails.",
  "summary_extended": "The number of cyberattacks reported in Germany rose by more than 15% in 2019 compared to the previous year, reaching a total of 100,514 incidents, as reported by the Federal Criminal Police Office (BKA). Main targets were companies and public institutions, selected for their high potential criminal profits. The primary threat remains attacks using ransomware, which encrypts data and demands payment in cryptocurrency, mostly Bitcoin, for decryption. Attackers often also steal confidential data and threaten to publish it. During the COVID-19 pandemic (March to August 2020), cybercriminals leveraged the crisis by cloning government websites related to corona financial aid and sending fake emails supposedly from authorities or banks to spread malware. The BKA highlighted the international, highly professional network of cybercriminals, who can swiftly adapt to new opportunities like the pandemic. In 2019, 22,574 suspects in cybercrime were investigated, a 2% increase from 2018. The financial damage to the German economy is estimated at over 100 billion euros, according to the industry association Bitkom cited by BKA. The BKA advised companies and citizens to utilize current virus protection, strong passwords, and regular backups, and to be skeptical of emails from unknown senders. The DPolG police union called for more IT experts in security agencies and easing the entry of career changers to police services, with calls for legislative changes to allow police to monitor messenger communications more effectively.",
  "actor_primary": "international cybercriminal networks",
  "target_primary": null,
  "location_text": "Germany",
  "location_region": null,
  "location_coordinates_lat": 51.1657,
  "location_coordinates_lon": 10.4515,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article reports a concrete increase in cyberattacks in Germany in 2019 attributed to criminal actors using ransomware and malware, indicating ongoing hostile cyber activity. The BKA explicitly links these activities to a professional, international criminal network. The pandemic-related exploitation is detailed with specific tactics such as fake government websites and emails. No indication of defensive-only content justifies HYBRID_SIGNAL with aggressor set true.",
  "event_time_utc": "2019-12-31T23:59:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T13:45:00.706Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Dec 31, 2019, 23:59 UTC

Event time confidence

pm24h

Location

Germany

Primary actor

international cybercriminal networks

Country

Germany

Countries

Germany

Tags

Cybercrime, Ransomware, Malware, BKA, Germany, COVID-19 exploitation, Data theft

Nodes

Node 2: 5th Column

Loading signal...

{ "id": "b7afbc2d-3c62-400e-a4d2-c3045dc0c20a", "url": "https://tagesschau.de/inland/cyberangriffe-bka-101.html", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Germany", "source_reliability": "A", "info_credibility": "3", "tags": [ "Cybercrime", "Ransomware", "Malware", "BKA", "Germany", "COVID-19 exploitation", "Data theft" ], "nodes": [ "Node 2: 5th Column" ], "countries": [ "Germany" ], "where_text": "Cyberspace", "headline": "Cybercrime Hits Record High in Germany in 2019, BKA Warns of Rising Ransomware Attacks", "description": "In 2019, Germany experienced a record number of cyberattacks, with over 100,000 incidents, marking a rise of more than 15% from the previous year, according to the Federal Criminal Police Office (BKA). Companies and public institutions were the main targets due to the high criminal profits possible. Ransomware, which encrypts victims' data and demands Bitcoin payments for decryption, remains the largest threat, often combined with data theft and extortion. During the COVID-19 pandemic, criminals exploited the crisis by cloning government financial aid websites and sending fake emails from authorities to spread malware. Cybercriminal networks are international and highly professional, demonstrating flexibility in adapting to new opportunities. In 2019, German police investigated over 22,500 cybercrime suspects, a 2% increase from 2018. The financial impact on the German economy is estimated at over 100 billion euros. The BKA urged increased preventive measures including updated virus protection, strong passwords, regular data backups, and caution regarding unknown emails. The police union DPolG demanded more IT specialists in security agencies and legislative reforms permitting police surveillance of messenger communications.", "summary_short": "In 2019, cyberattacks in Germany reached a record high with over 100,000 incidents, mainly targeting companies and public institutions, according to BKA. The COVID-19 pandemic was exploited by criminals via fake government websites and emails.", "summary_extended": "The number of cyberattacks reported in Germany rose by more than 15% in 2019 compared to the previous year, reaching a total of 100,514 incidents, as reported by the Federal Criminal Police Office (BKA). Main targets were companies and public institutions, selected for their high potential criminal profits. The primary threat remains attacks using ransomware, which encrypts data and demands payment in cryptocurrency, mostly Bitcoin, for decryption. Attackers often also steal confidential data and threaten to publish it. During the COVID-19 pandemic (March to August 2020), cybercriminals leveraged the crisis by cloning government websites related to corona financial aid and sending fake emails supposedly from authorities or banks to spread malware. The BKA highlighted the international, highly professional network of cybercriminals, who can swiftly adapt to new opportunities like the pandemic. In 2019, 22,574 suspects in cybercrime were investigated, a 2% increase from 2018. The financial damage to the German economy is estimated at over 100 billion euros, according to the industry association Bitkom cited by BKA. The BKA advised companies and citizens to utilize current virus protection, strong passwords, and regular backups, and to be skeptical of emails from unknown senders. The DPolG police union called for more IT experts in security agencies and easing the entry of career changers to police services, with calls for legislative changes to allow police to monitor messenger communications more effectively.", "actor_primary": "international cybercriminal networks", "target_primary": null, "location_text": "Germany", "location_region": null, "location_coordinates_lat": 51.1657, "location_coordinates_lon": 10.4515, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article reports a concrete increase in cyberattacks in Germany in 2019 attributed to criminal actors using ransomware and malware, indicating ongoing hostile cyber activity. The BKA explicitly links these activities to a professional, international criminal network. The pandemic-related exploitation is detailed with specific tactics such as fake government websites and emails. No indication of defensive-only content justifies HYBRID_SIGNAL with aggressor set true.", "event_time_utc": "2019-12-31T23:59:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-04-28T13:45:00.706Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }