.uno

One continent under attack. One company built to defend it. Uno.

77documented incidents against European infrastructure since January 2022
35of them in Germany
–in the last 90 days
–days since the last one

01 · The evidence

Four years of hostile acts. One map.

77 documented incidents since January 2022. 35 of them in Germany. Every marker links to its source.

Show
77 of 77 shown
Map of Europe with 77 documented infrastructure incidents, 2022 to 2026
The January 2022 Svalbard cable cut sits above the top edge of this map. Still counted.

Physical sabotage is loud. Cyber is quiet, and once it is switched on it spreads at machine speed.

  • Physical attacks dominate this map because they cannot be hidden. Cyber access sits unnoticed for months and is activated on demand.
  • When it is, it does not stay local: one vendor, one protocol, one reused password across a hundred substations.
  • The 15 cyber incidents here are the ones that surfaced. The BSI, Germany's federal cyber-security agency, logged 692 reports from regulated operators in the first half of 2026.19

Incidents per year

All 77 documented incidents. 2026 runs to 24 September.

Where

By country. Germany is the outlier, and the point.

Curated from public reporting and from prosecutors' and ministries' own releases. Not a census: cyber intrusions are reported to regulators, not to newspapers.

Show the filtered incidents as a list
DateWhereKindWhat happenedAttributionSource

02 · Germany, main character

The most attacked industrial country in Europe. We would have preferred a different superlative.

  • 26%of the EU's industrial output23
  • 130,000 kmof high-voltage line, ~250 transmission substations27
  • 30,870wind turbines, plus 100+ GW of solar25
  • 212,000public charging points24
  • 1,841hospitals26
  • Remotealmost all of it remotely controlled, almost none of it built with a threat model
48%
of regulated critical operators (KRITIS) meet the legal bar for attack detection.
BSI, Lage der IT-Sicherheit 20253
692
cyber incident reports to the BSI from regulated operators, first half of 2026.
BSI, NIS-2 in Zahlen19
€271bn
annual damage to German firms from cyber, espionage and sabotage. Three quarters cyber.
Bitkom / BfV, Aug 20262
37%
of attacked firms point to foreign intelligence services. In 2023: 7%.
Bitkom / BfV, Aug 20262
~30,000
vulnerable Exchange servers still online in hospitals, schools and critical sites.
BSI, Lage der IT-Sicherheit 20253
>165
suspected physical sabotage cases, January to August 2026. The visible part.
BKA, Sep 20261
  1. Feb 2022Enercon. Viasat hack cuts remote control of ~5,800 wind turbines. Attributed to the GRU.
  2. Apr 2022Deutsche Windtechnik. Ransomware cuts remote links to ~2,000 turbines.
  3. Aug 2024Langen. GRU hackers (APT28) inside German air traffic control's office network.
  4. Nov 2025Stadtwerke Detmold. Ransomware at a municipal utility; customer systems down six weeks.
  5. Jan 2026Berlin-Lichterfelde. Cable-bridge arson; ~100,000 people without power for four days.
  6. Sep 2026Jänschwalde and Bergheim. Rockets trailing wire short-circuit two substations; 4,200 MW trips.

„Jede aus dem Internet erreichbare Institution oder Person ist prinzipiell bedroht.“"Every institution or person reachable from the internet is, in principle, under threat."

03 · Who's doing it

Who's doing it? Depends on the week.

Attribution is slow and often never arrives. The field is crowded.

Cyber, state-linked

Hackers with valves

  • Opened a Norwegian dam valve for four hours before anyone noticed.
  • Burst pipes at a Danish waterworks; probed Polish and French water plants.
  • December 2025: near-blackout for 500,000 people in Poland after an attack on wind farms and heat-and-power plants.11
  • GRU units inside German air traffic control, wind fleets and logistics firms.

Cyber, commercial

Ransomware, the boring apocalypse

  • Südwestfalen-IT: 72 municipalities offline for months.
  • Three hospitals in Westphalia, on Christmas Eve.
  • Oiltanking: fuel terminals and 233 petrol stations.
  • Two thirds of German firms name organised crime as an attacker.2

State, outsourced

Russian intelligence, on a gig basis

  • "Low-level agents" recruited on Telegram for a few hundred euros.
  • The Leipzig parcel bomb, the Vilnius IKEA, the Munich incendiaries.
  • 58 German investigations in five years, 30 arrests, 13 convictions.7
  • Designed to look like ordinary vandalism, says the BfV.8

Everyone else

Anchors, drones, lighters

  • Shadow-fleet tankers dragging anchors across Baltic cables, seven or eight times since 2023.10
  • 1,000+ suspicious drone flights over German sites in 2025, most never identified.9
  • Domestic extremists: Berlin blacked out twice; one man with pyrotechnic rockets tripped 4,200 MW.

A substation cannot tell a GRU officer from a climate anarchist from a bored teenager with a Telegram account. Every operator in Europe now has to assume hostile intent by default.

„Wir sind nicht im Krieg, aber wir sind auch nicht mehr im Frieden.“ "We are not at war, but we are no longer at peace either."

Friedrich Merz, German Chancellor, 29 September 202531

"This is hybrid warfare, and we have to take it very seriously."

Ursula von der Leyen, European Parliament, 8 October 202531

04 · The money arrived

Europe noticed. Then it did something unusual and budgeted for it.

In eighteen months the rules and the money moved together.

  1. Mar 2025Germany amends its constitution. €500bn infrastructure fund; defence spending above 1% of GDP freed from the debt brake, cybersecurity included.12
  2. Jun 2025NATO agrees on 5% of GDP, 1.5% of it for infrastructure protection, cyber defence and civil preparedness.13
  3. Dec 2025NIS2 becomes German law. ~29,500 companies in scope, up from ~4,000. Attack detection, 24-hour reporting, personal liability for management.14
  4. Jan 2026Germany and Israel sign a Cyber- und Sicherheitspakt. See below.16
  5. Mar 2026The KRITIS-Dachgesetz comes into force. Resilience duties for ~1,300 operators.18
  6. Sep 2026The EU Cyber Resilience Act's reporting duties go live. Full application December 2027.21

12 January 2026 · Berlin

„Israel ist einer unserer wichtigsten Partner im Bereich Cybersicherheit und wird mit diesem Abkommen unser Premiumpartner.“"Israel is one of our most important partners in cybersecurity and, with this agreement, becomes our premium partner."

Alexander Dobrindt, German Interior Minister, signing the Cyber- und Sicherheitspakt with Benjamin Netanyahu.16

  • What it covers: a next-generation "Cyber Dome", a joint Cyber Center of Excellence, shared exercises and simulations in cyber and AI, cooperation on cyber-risk regulation and on drone detection and defence.16
  • How it started: a letter of intent between Israel's National Cyber Directorate and the German interior ministry in December 2025; the first joint German–Israeli cyber-defence exercise was announced in January 2026.33
  • What it is: a political declaration of intent rather than a treaty, with working-level cooperation including technology exchange, in the government's own words.33 For an Israeli vendor that is the difference between "foreign supplier" and "partner country" when a German procurement committee reads the file.
$11.9bn
Europe's OT security market by 2030, from $5.7bn in 2025. NIS2 named as the main driver.
MarketsandMarkets, Mar 202622
17,945
companies registered under NIS2 by June 2026, plus 1,231 KRITIS operators with 2,180 facilities.
BSI19
€109.7bn
Germany's draft 2027 defence budget, up 33% in a year. Cyber counts as defence.
Bundesfinanzministerium, Jul 202620

The catch

  • "EU added value" is becoming a mandatory award criterion for public buyers.30
  • The proposed Cybersecurity Act 2 lets Brussels blacklist high-risk suppliers across every NIS2 sector.
  • BSI C5 attestations already gate cloud deals in German healthcare.
  • None of it is aimed at Israel. It rewards whoever shows up early, with a European entity and a European reference customer.

What the buyers look like

  • Many and mid-sized: municipal utilities, hospitals, Mittelstand plants. Not national champions.
  • Newly liable: since December 2025 their managers are personally on the hook for attack detection and 24-hour reporting.
  • Half blind: fewer than half of the regulated critical operators meet the BSI's bar for attack detection. They have to buy something, and soon.

That is the whole argument, and we will stop selling now. The map, unfortunately, will keep updating itself.

Revent Capital GmbH, Berlin · revent.vc · A private note to the founders of security.uno, September 2026. Incident data compiled from public reporting; every marker on the map links to its source, and the statistics are cited below. Set in Mona Sans, built in one evening.

Sources for the statistics and quotes
  1. BKA "Lageupdate Hybride Bedrohung", reported by NDR, WDR and SZ, 4 Sep 2026, via ZDF heute.
  2. Bitkom and BfV, Wirtschaftsschutz 2026, 26 Aug 2026: press release; BfV statement here.
  3. BSI, Die Lage der IT-Sicherheit in Deutschland 2025, 11 Nov 2025: press release with Plattner quote; KRITIS detection maturity, Exchange servers and vulnerability figures as summarised by Security-Insider and mgm.
  4. Generalbundesanwalt caseload, answer to a parliamentary question, Bundestag hib, 7 Aug 2026.
  5. BfV, Verfassungsschutzbericht 2025, counter-espionage chapter on low-level agents: verfassungsschutz.de.
  6. BKA President Münch on more than 1,000 suspicious drone flights in 2025, dpa, Dec 2025.
  7. Baltic Sea cable incidents since 2023, Baird Maritime factbox.
  8. Poland stops cyberattacks on energy infrastructure, Chancellery of the Prime Minister, Dec 2025.
  9. Grundgesetz amendment and the €500bn Sondervermögen, bpb, Mar 2025.
  10. NATO, The Hague Summit Declaration, 25 Jun 2025.
  11. BSI on the NIS2UmsuCG in force since 6 Dec 2025 and the ~29,500 entities in scope, press release, Jan 2026.
  12. Germany–Israel Cyber- und Sicherheitspakt, 12 Jan 2026: Jerusalem Post, Table.Media.
  13. KRITIS-Dachgesetz: Bundestag, 29 Jan 2026; in force 16 Mar 2026, summary by Görg.
  14. BSI, NIS-2 in Zahlen (registrations and 692 initial incident reports to 30 Jun 2026) and KRITIS in Zahlen.
  15. Bundesfinanzministerium, Regierungsentwurf Bundeshaushalt 2027, 6 Jul 2026.
  16. European Commission, Cyber Resilience Act reporting obligations.
  17. MarketsandMarkets, Europe OT security market, Mar 2026.
  18. Eurostat, Industrial production statistics (Germany 26% of EU sold production, 2024).
  19. Bundesnetzagentur, public charging infrastructure, as of 1 Aug 2026.
  20. Installed wind and solar capacity end-2025 (Fraunhofer ISE figures), via Wind power in Germany and Solar power in Germany.
  21. Number of hospitals in Germany 2024 (Destatis), via Statista.
  22. VKU chief executive Ingbert Liebing on substations and high-voltage lines, t-online, 17 Sep 2026.
  23. EU Tech Sovereignty Package, summary by BHO Legal; Cybersecurity Act 2 proposal, Covington; C5 in healthcare, BVMed.
  24. Government answer on the Germany–Israel pact (declaration of intent, working-level cooperation, technology exchange), Bundestag hib, 3 Mar 2026; joint cyber-defence exercise, BMI press release, Jan 2026; INCD–BMI letter of intent, Dec 2025, via Jerusalem Post.
  25. Quotes: Merz, ZDF, 29 Sep 2025; von der Leyen, European Parliament, 8 Oct 2025.