Germany

Germany ranks #2 globally for ransomware attacks, with 914 confirmed victims in this database — representing 4.3% of the worldwide total. The most active ransomware groups targeting Germany include Safepay, Qilin, Akira.

The most frequently targeted industries in Germany are Manufacturing, Technology, Business Services. The healthcare sector is particularly vulnerable because attacks on hospitals and medical providers can create life-threatening situations, increasing pressure to pay ransoms quickly.

Germany's attack volume reflects broader trends in ransomware targeting: as one of the world's largest economies with extensive digital infrastructure, Germany presents a high-value target environment with many large organisations, diverse industries, and significant data assets that ransomware groups seek to exploit.

Organisations in Germany should consider the active threat groups documented here when assessing their cybersecurity posture, implementing detection rules, and prioritising incident response planning.