Germany Hits 92% Surge in Data Leak Posts
Germany has reclaimed its position as the primary focus for cyber extortion in Europe, according to new data from Google Threat Intelligence (GTI). Data leak site (DLS) posts targeting German organizations grew by 92% in 2025—triple the European average—signaling a sharp escalation after a relative lull in 2024.
“The speed of this shift is alarming. Germany is now experiencing the highest pressure levels we saw in 2022 and 2023,” said Jamie Collier, senior threat intelligence analyst at Google. The rise comes as overall DLS posts globally increased nearly 50% in the same period.
Why Germany?
Germany’s renewed attractiveness to cybercriminals is not due to its number of companies—France and Italy have more active enterprises. Instead, its status as an advanced European economy with an increasingly digitized industrial base makes it a ripe target.
“Threat actors are pivoting toward the 'ripe markets' of the German Mittelstand,” Collier explained. These mid-sized firms often have weaker defenses but high-value data. Additionally, the use of AI to automate high-quality localization has eroded language barriers that once protected non-English-speaking nations.
GTI has observed multiple cybercriminal groups advertising for access to German companies, offering a cut of extortion fees. For example, the threat actor known as Sarcoma has been targeting German businesses since November 2024.
Background
The shift marks a return to the intense pressure seen in Germany during 2022 and 2023, which had cooled in 2024 when the UK led in DLS victims. The UK now sees declining leak volumes as larger “big game” targets there improve security or settle incidents privately via cyber insurance.
German organizations, by contrast, face a growing wave of attacks that exploit the Mittelstand’s digitization push. This convergence of factors—AI-enabled localization and a victim profile shift—has made Germany a prime focus for extortion groups.
What This Means
The 92% growth rate signals an urgent need for German businesses to bolster cybersecurity measures. “Companies that have not yet invested in robust incident response and insurance may find themselves at heightened risk,” warned Robin Grunewald, also a GTI analyst.
Policymakers in Europe should take note: the linguistic pivot driven by AI means no nation can rely on language as a shield. Germany’s experience serves as a warning for other highly digitized economies. Read more about the Mittelstand vulnerability.
The trend is expected to continue unless businesses adopt proactive defense strategies and threat intelligence sharing improves across Europe.