Google GTI: German Data-Leak Site Listings Rose 92% in 2025
Summary
Google Threat Intelligence Group says data-leak-site listings naming German victims rose 92% in 2025. Organizations with fewer than 5,000 employees accounted for 96% of German ransomware leak posts; these figures track public claims, not confirmed incidents.
Key points
- GTIG data shows data-leak-site victim postings for Germany rose 92% in 2025, three times the European average; Germany overtook the UK after the UK led in 2024.
- The article cautions that leak-site counts are an incomplete measure: groups typically post victims who do not begin or complete extortion negotiations.
- After disruption of major operations including LockBit and ALPHV, mid-tier groups such as SafePay and Qilin gained prominence in Germany.
- SafePay claimed breaches of 76 German companies in 2025, accounting for 25% of German victim posts; Qilin tripled its operational tempo in Germany in Q3 2025.
- Organizations with fewer than 5,000 employees accounted for 96% of German ransomware leak posts. Manufacturing represented 23%, and legal and professional services 14%.
- GTIG observed criminal forum advertisements seeking access to German companies; the article cites Sarcoma targeting businesses in Germany and other developed nations.
- The article recommends vendor tiering and multifactor authentication as part of stronger third-party risk management.
Article Details
- Publisher
- Google Threat Intelligence Group (GTIG)
- Report Period
- 2025; includes Qilin activity reported in early 2026
- Scope
- European data leak site activity, focusing on ransomware targeting in Germany.
- Key Statistics
- German data leak site postings increased 92% in 2025 compared with 2024, three times the European average growth rate.
- Organizations with fewer than 5,000 employees accounted for 96% of German ransomware leaks in 2025.
- SafePay claimed breaches of 76 German companies in 2025, representing 25% of German victim posts that year.
- Manufacturing accounted for 23% of German data leak victims in 2025; legal and professional services accounted for 14%, construction and engineering 11%, and retail 10%.
- Qilin tripled its operational tempo in Germany during Q3 2025; the article reports 13 German victims posted in early 2026.
- Recommendations
- Large enterprises should adopt proactive third-party risk management, including vendor tiering and multifactor authentication.
MITRE ATT&CK
T1195 · Supply Chain CompromiseThe article says threat actors exploit complex supply chains and describes suppliers and contractors as potential pivot points due to their sensitive data and privileged network access.T1486 · Data Encrypted for ImpactThe article describes ransomware and extortion activity and characterizes encrypted impact as part of the incidents.T1567 · Exfiltration Over Web ServiceThe article describes leaked company data being posted on data leak sites as part of extortion activity.
Threat Actors
ALPHVThe article identifies ALPHV as a major cyber criminal operation affected by law enforcement actions that contributed to a more fragmented ransomware ecosystem.LockBitThe article identifies LockBit as a major ransomware brand disrupted by law enforcement, contributing to a rebalancing of the cyber criminal ecosystem.QilinThe article reports that Qilin tripled its operational tempo in Germany during Q3 2025 and had 13 German victims posted in early 2026.SafepayThe article reports that SafePay gained prominence in Germany and claimed breaches of 76 German companies in 2025; these are actor claims reflected in data leak site posts.SarcomaGTIG reports that Sarcoma has targeted businesses in several developed nations, including Germany, since November 2024; the article also describes a forum post seeking a partnership to target German victims.
Countries
GermanyGermany became the primary focus for cyber extortion in Europe in 2025, with data leak site postings affecting the country rising 92% yearâoverâyear and outpacing the regional average.United KingdomThe shift of DLS activity from the UK to Germany is driven by targeting of the digitized industrial Mittelstand rather than sheer number of firms.
Industries
Construction & EngineeringHowever, the German cyber criminal landscape is characterized by its variety, with legal & professional services (14%), construction & engineering (11%), and retail (10%) all targeted.Legal & professional servicesHowever, the German cyber criminal landscape is characterized by its variety, with legal & professional services (14%), construction & engineering (11%), and retail (10%) all targeted.ManufacturingManufacturing was the most targeted sector (23%), while legal and professional services saw notable growth as highâvalue targets.RetailHowever, the German cyber criminal landscape is characterized by its variety, with legal & professional services (14%), construction & engineering (11%), and retail (10%) all targeted.