Germany sees rise in ransomware attacks via stolen credentials

Between January and May 2026, Germany recorded 182 ransomware victims, representing a 7.7 percent increase compared to the same period in the previous year.

A growing number of these attacks do not rely on exploiting technical vulnerabilities but instead utilize stolen credentials obtained through infostealer malware. This trend presents a significant challenge for businesses, as attackers can move undetected within a network for weeks or months before initiating encryption.

Because of this prolonged presence, backups created immediately before a visible attack may not serve as clean recovery points. Experts suggest that companies must adapt their backup and recovery strategies by implementing immutable backups, conducting isolated recovery tests, and securing privileged access.