Germany critical infrastructure faces rising cyberattack threats

Critical infrastructure operators in Germany are facing escalating cyber threats, highlighted by a significant rise in DDoS attacks. Data from the Federal Criminal Police Office shows 36,706 DDoS attacks recorded in 2025, a 25 percent increase from the previous year. The Federal Office for Information Security (BSI) reports that its DDoS index, which tripled since 2021, reached 320 points in June 2026.

Recent incidents include attacks on the city of Wiesbaden, municipal systems in Mülheim an der Ruhr, and the energy provider Enseco. Beyond cybercriminals, the Federal Office for the Protection of the Constitution has warned that foreign intelligence services are actively scouting German energy infrastructure to prepare for future attacks.

To combat these risks, the NIS2 directive and the German NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG), which came into force in December 2025, impose new security requirements. The legislation affects approximately 29,500 companies in Germany across 18 critical sectors. Experts emphasize that improving visibility across IT and Operational Technology (OT) networks and implementing strict access credential controls are essential steps for compliance and defense.