Germany is Europe's top ransomware target, expert says

Germany is the European country most affected by ransomware attacks, a German cybersecurity expert has said, adding that the incidents often trace back to Russia.

Christian Dörr, a cybersecurity expert at the Hasso Plattner Institute (HPI) in Potsdam, made the remarks ahead of a national cybersecurity conference in the city on Wednesday.

Ransomware attacks involve malicious software that encrypts data and systems, with cybercriminals seeking to extort ransom payments from victims.

"Germany is Europe's hotspot for ransomware," Dörr said. The growth in such attacks was nearly twice as high as in France, the second most-affected EU country, he said.

Dörr said the ransom demands from criminals average in the hundreds of thousands of euros. On top of that, the attacks often result in weeks of downtime which can drive companies into bankruptcy, he said.

The expert said Germany lags behind on cybersecurity awareness, despite having numerous highly innovative companies and global market leaders that make it an attractive target for valuable information. "We have been falling behind in global comparisons for many years," he said.

He added that the largest percentage increase in attacks was currently being seen in public administration, where structural factors made good cybersecurity particularly difficult to implement.

Ransom payments are by far the highest in the health-care sector, Dörr said. Criminals steal not only business data but also sensitive patient health data, which is particularly valuable on the black market and can be used to extort patients a second time, he said.

Ransomware attacks have in the past temporarily paralysed hospitals, municipal administrations and transport operators.

Some 1,041 cases of ransomware attacks and other forms of data theft linked to extortion were reported across Germany last year, up from 950 reports in 2024, according to German police data.

Cybercrime is a global business, but traces very frequently lead to Russia, Dörr said. He said there was "little risk of prosecution and extradition" there, as long as criminals choose their victims outside Russia.

In recent years, an increasing entanglement between cybercriminals and state actors could be observed, Dörr said. "On the one hand because states have discovered this as an additional source of income for themselves, but also because perpetrators come from the ranks of these countries' offensive cyber warriors and can 'earn a little extra' after hours," he said.