Cybernews Germany Faces Surge in Cyber Extortion Amid Rising Data Leaks
Article Content
- •Germany saw a 92% increase in data leaks in 2025, the highest in Europe.
- •Cybercriminals are targeting Germany's Mittelstand due to enhanced security in larger firms.
- •The use of AI for localization is eroding language barriers, facilitating attacks.
In 2025, Germany experienced a significant resurgence in cyber extortion, becoming the primary target for data leaks in Europe. Google Threat Intelligence reported a staggering 92% increase in data leak incidents, outpacing the European average. This increase follows a period of relative calm in 2024 and mirrors the high-pressure environment seen in 2022 and 2023. The rise in attacks is attributed to Germany's advanced economy and digitized industrial base, making it appealing to cybercriminals. Notably, while UK-based organizations saw a decrease in data leak site postings, non-English-speaking countries, particularly Germany, experienced a surge. The cybercriminal ecosystem's maturation, including AI-driven localization, has diminished the protective barrier of language. Additionally, larger targets in North America and the UK are improving their defenses, prompting attackers to focus on Germany's small- to medium-sized enterprises, known as the Mittelstand. Threat actors are actively seeking partnerships to target German companies, indicating a strategic shift in their operations. However, experts caution that reliance solely on data leak site numbers can be misleading, as these figures often reflect only those victims who refuse to negotiate. Overall, the situation underscores a complex and evolving threat landscape in Germany.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Sarcoma in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…
CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…