.uno

One continent under attack. One company built to defend it. Uno.

77documented incidents against European infrastructure since January 2022
35of them in Germany
–in the last 90 days
–days since the last one

01 · The evidence

Four years of hostile acts. One map.

Show
77 of 77 shown
Map of Europe with 77 documented infrastructure incidents, 2022 to 2026
The January 2022 Svalbard cable cut sits above the top edge of this map. Still counted.

Physical sabotage is loud. Cyber is quiet, and once it is switched on it spreads at machine speed.

  • Physical attacks dominate this map because they cannot be hidden. Cyber access sits unnoticed for months and is activated on demand.
  • When it is, it does not stay local: one vendor, one protocol, one reused password across a hundred substations.
  • The 15 cyber incidents here are the ones that surfaced. The BSI, Germany's federal cyber-security agency, logged 692 reports from regulated operators in the first half of 2026.19

Incidents per year

All 77 documented incidents. 2026 runs to 24 September.

Where

By country. Germany is the outlier, and the point.

Curated from public reporting and from prosecutors' and ministries' own releases. Not a census: cyber intrusions are reported to regulators, not to newspapers.

Show the filtered incidents as a list
DateWhereKindWhat happenedAttributionSource

02 · Germany

Germany is the most attacked industrial country in Europe. We would have preferred a different superlative.

48%
of regulated critical operators (KRITIS) meet the legal bar for attack detection.
BSI, Lage der IT-Sicherheit 20253
692
cyber incident reports to the BSI from regulated operators, first half of 2026.
BSI, NIS-2 in Zahlen19
€271bn
annual damage to German firms from cyber, espionage and sabotage. Three quarters cyber.
Bitkom / BfV, Aug 20262
37%
of attacked firms point to foreign intelligence services. In 2023: 7%.
Bitkom / BfV, Aug 20262
~30,000
vulnerable Exchange servers still online in hospitals, schools and critical sites.
BSI, Lage der IT-Sicherheit 20253
>165
suspected physical sabotage cases, January to August 2026. The visible part.
BKA, Sep 20261
  1. Feb 2022Enercon. Viasat hack cuts remote control of ~5,800 wind turbines. Attributed to the GRU.
  2. Apr 2022Deutsche Windtechnik. Ransomware cuts remote links to ~2,000 turbines.
  3. Aug 2024Langen. GRU hackers (APT28) inside German air traffic control's office network.
  4. Nov 2025Stadtwerke Detmold. Ransomware at a municipal utility; customer systems down six weeks.
  5. Jan 2026Berlin-Lichterfelde. Cable-bridge arson; ~100,000 people without power for four days.
  6. Sep 2026Jänschwalde and Bergheim. Rockets trailing wire short-circuit two substations; 4,200 MW trips.

„Wir sind nicht im Krieg, aber wir sind auch nicht mehr im Frieden.“"We are not at war, but we are no longer at peace either."

03 · The money arrived

Europe noticed. Then it did something unusual and budgeted for it.

In eighteen months the rules and the money moved together.

  1. Mar 2025Germany amends its constitution. €500bn infrastructure fund; defence spending above 1% of GDP freed from the debt brake, cybersecurity included.12
  2. Jun 2025NATO agrees on 5% of GDP, 1.5% of it for infrastructure protection, cyber defence and civil preparedness.13
  3. Dec 2025NIS2 becomes German law. ~29,500 companies in scope, up from ~4,000. Attack detection, 24-hour reporting, personal liability for management.14
  4. Jan 2026Germany and Israel sign a Cyber- und Sicherheitspakt. See below.16
  5. Mar 2026The KRITIS-Dachgesetz comes into force. Resilience duties for ~1,300 operators.18
  6. Sep 2026The EU Cyber Resilience Act's reporting duties go live. Full application December 2027.21

12 January 2026 · Berlin

„Israel ist einer unserer wichtigsten Partner im Bereich Cybersicherheit und wird mit diesem Abkommen unser Premiumpartner.“"Israel is one of our most important partners in cybersecurity and, with this agreement, becomes our premium partner."

Alexander Dobrindt, German Interior Minister, signing the Cyber- und Sicherheitspakt with Benjamin Netanyahu.16

That is the whole argument, and we will stop selling now. The map, unfortunately, will keep updating itself.

Revent Capital GmbH, Berlin · revent.vc · A private note, September 2026. Incident data compiled from public reporting; every marker on the map links to its source, and the statistics are cited below. Set in Mona Sans, built in one evening.

Sources for the statistics and quotes
  1. BKA "Lageupdate Hybride Bedrohung", reported by NDR, WDR and SZ, 4 Sep 2026, via ZDF heute.
  2. Bitkom and BfV, Wirtschaftsschutz 2026, 26 Aug 2026: press release; BfV statement here.
  3. BSI, Die Lage der IT-Sicherheit in Deutschland 2025, 11 Nov 2025: press release; KRITIS detection maturity, Exchange servers and vulnerability figures as summarised by Security-Insider and mgm.
  4. Grundgesetz amendment and the €500bn Sondervermögen, bpb, Mar 2025.
  5. NATO, The Hague Summit Declaration, 25 Jun 2025.
  6. BSI on the NIS2UmsuCG in force since 6 Dec 2025 and the ~29,500 entities in scope, press release, Jan 2026.
  7. Germany–Israel Cyber- und Sicherheitspakt, 12 Jan 2026: Jerusalem Post, Table.Media.
  8. KRITIS-Dachgesetz: Bundestag, 29 Jan 2026; in force 16 Mar 2026, summary by Görg.
  9. BSI, NIS-2 in Zahlen (692 initial incident reports to 30 Jun 2026) and KRITIS in Zahlen.
  10. European Commission, Cyber Resilience Act reporting obligations.
  11. Friedrich Merz, Ständehaus Treff, Düsseldorf, ZDF, 29 Sep 2025.