Over 100 German public authorities have been victims of ransomware attacks, encrypting their IT systems and demanding ransom, with no comprehensive federal overview available as of June 2021.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

A survey by BR and Zeit Online revealed that in the past six years, more than 100 ransomware attacks have successfully encrypted IT systems of German authorities and public institutions, including state parliaments, ministries, universities, hospitals, and police departments. The German Federal Interior Ministry confirmed it lacks a comprehensive overview due to absence of a mandatory reporting system. Several German states and municipal associations also lack detailed data, and some declined to specify the number of ransom payments. Local examples include the municipality of Kammeltal, whose servers were encrypted in early April 2021. Experts and politicians call for unified reporting requirements and awareness campaigns to strengthen IT security across municipalities. The Bundeskriminalamt (BKA) identifies ransomware as a major cyber threat to public institutions, with global ransom payments in the millions. Despite law enforcement advice not to pay ransoms, some entities have done so, such as the Stuttgart State Theater in 2019. The fragmented landscape of cyber defense between federal, state, and municipal levels results in a lack of coordinated response and support.

Classification

Confidence: High

The article explicitly describes ransomware attack incidents affecting multiple German public institutions, with perpetrators encrypting data and demanding ransom, which is hostile cyber aggressor activity.

Source URL

https://tagesschau.de/investigativ/br-recherche/ransomware-103.html

Open source

Provenance

Publisher: extension
Submitted: Apr 28, 2026, 13:45 UTC
Last updated: Nov 8, 2026, 19:26 UTC
Event time: Apr 1, 2021, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "f01e287f-52bf-49d2-905d-a96f4ad25f48",
  "url": "https://tagesschau.de/investigativ/br-recherche/ransomware-103.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Germany",
  "source_reliability": "A",
  "info_credibility": "3",
  "tags": [
    "ransomware",
    "cyberattacks",
    "Germany",
    "public authorities",
    "IT security",
    "data encryption",
    "BR Recherche",
    "cybercrime",
    "BKA",
    "ransom demand"
  ],
  "nodes": [],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "A survey by BR and Zeit Online revealed that in the past six years, more than 100 ransomware attacks have successfully encrypted IT systems of German authorities and public institutions, including state parliaments, ministries, universities, hospitals, and police departments. The German Federal Interior Ministry confirmed it lacks a comprehensive overview due to absence of a mandatory reporting system. Several German states and municipal associations also lack detailed data, and some declined to specify the number of ransom payments. Local examples include the municipality of Kammeltal, whose servers were encrypted in early April 2021. Experts and politicians call for unified reporting requirements and awareness campaigns to strengthen IT security across municipalities. The Bundeskriminalamt (BKA) identifies ransomware as a major cyber threat to public institutions, with global ransom payments in the millions. Despite law enforcement advice not to pay ransoms, some entities have done so, such as the Stuttgart State Theater in 2019. The fragmented landscape of cyber defense between federal, state, and municipal levels results in a lack of coordinated response and support.",
  "summary_short": "Over 100 German public authorities have been victims of ransomware attacks, encrypting their IT systems and demanding ransom, with no comprehensive federal overview available as of June 2021.",
  "summary_extended": null,
  "actor_primary": "ransomware criminals",
  "target_primary": null,
  "location_text": "Kammeltal and multiple locations across Germany including state parliaments of Saxony-Anhalt and Mecklenburg-Vorpommern, Stuttgart",
  "location_region": "Bavaria (for Kammeltal), Baden-Württemberg (for Stuttgart), Saxony-Anhalt, Mecklenburg-Vorpommern",
  "location_coordinates_lat": 48.5246,
  "location_coordinates_lon": 10.4232,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly describes ransomware attack incidents affecting multiple German public institutions, with perpetrators encrypting data and demanding ransom, which is hostile cyber aggressor activity.",
  "event_time_utc": "2021-04-01T00:00:00.000Z",
  "end_time_utc": "2021-04-10T23:59:59.000Z",
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T13:45:00.496Z",
  "updated_at": "2026-11-08T19:26:31.807Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Apr 1, 2021, 00:00 UTC

End time

Apr 10, 2021, 23:59 UTC

Event time confidence

pm24h

Location

Kammeltal and multiple locations across Germany including state parliaments of Saxony-Anhalt and Mecklenburg-Vorpommern, Stuttgart

Region

Bavaria (for Kammeltal), Baden-Württemberg (for Stuttgart), Saxony-Anhalt, Mecklenburg-Vorpommern

Primary actor

ransomware criminals

Country

Germany

Countries

Germany

Tags

ransomware, cyberattacks, Germany, public authorities, IT security, data encryption, BR Recherche, cybercrime, BKA, ransom demand

Loading signal...

{ "id": "f01e287f-52bf-49d2-905d-a96f4ad25f48", "url": "https://tagesschau.de/investigativ/br-recherche/ransomware-103.html", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Germany", "source_reliability": "A", "info_credibility": "3", "tags": [ "ransomware", "cyberattacks", "Germany", "public authorities", "IT security", "data encryption", "BR Recherche", "cybercrime", "BKA", "ransom demand" ], "nodes": [], "countries": [ "Germany" ], "where_text": "Cyberspace", "headline": null, "description": "A survey by BR and Zeit Online revealed that in the past six years, more than 100 ransomware attacks have successfully encrypted IT systems of German authorities and public institutions, including state parliaments, ministries, universities, hospitals, and police departments. The German Federal Interior Ministry confirmed it lacks a comprehensive overview due to absence of a mandatory reporting system. Several German states and municipal associations also lack detailed data, and some declined to specify the number of ransom payments. Local examples include the municipality of Kammeltal, whose servers were encrypted in early April 2021. Experts and politicians call for unified reporting requirements and awareness campaigns to strengthen IT security across municipalities. The Bundeskriminalamt (BKA) identifies ransomware as a major cyber threat to public institutions, with global ransom payments in the millions. Despite law enforcement advice not to pay ransoms, some entities have done so, such as the Stuttgart State Theater in 2019. The fragmented landscape of cyber defense between federal, state, and municipal levels results in a lack of coordinated response and support.", "summary_short": "Over 100 German public authorities have been victims of ransomware attacks, encrypting their IT systems and demanding ransom, with no comprehensive federal overview available as of June 2021.", "summary_extended": null, "actor_primary": "ransomware criminals", "target_primary": null, "location_text": "Kammeltal and multiple locations across Germany including state parliaments of Saxony-Anhalt and Mecklenburg-Vorpommern, Stuttgart", "location_region": "Bavaria (for Kammeltal), Baden-Württemberg (for Stuttgart), Saxony-Anhalt, Mecklenburg-Vorpommern", "location_coordinates_lat": 48.5246, "location_coordinates_lon": 10.4232, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article explicitly describes ransomware attack incidents affecting multiple German public institutions, with perpetrators encrypting data and demanding ransom, which is hostile cyber aggressor activity.", "event_time_utc": "2021-04-01T00:00:00.000Z", "end_time_utc": "2021-04-10T23:59:59.000Z", "event_time_confidence": "pm24h", "created_at": "2026-04-28T13:45:00.496Z", "updated_at": "2026-11-08T19:26:31.807Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }