Microsoft: Germany Is EU’s Top Cyberattack Target

Among EU countries, Germany was the country where Microsoft customers were most frequently affected by cyberthreats in the first half of 2026. Reported ransomware attacks there rose by 276 percent in the twelve months to June 2026. To counter increasingly autonomous attacks by AI agents, Microsoft recommends deploying its own AI agents with unique digital identities.

RelatedGoogle Pays Publishers for AI Answers  /  AI Spending Rises, but Only One in Five Companies Has Scaled Up

Germany Tops the EU Ranking

Among EU member states, Germany was the country where Microsoft customers were most frequently affected by cyberthreats in the first half of 2026. Reported ransomware attacks rose by 276 percent in the twelve months to June 2026. Ransomware is malicious software that criminals use to encrypt data and demand payment to release it. According to Trending Topics, ransomware cases recorded by Microsoft in Germany rose year on year from 59 to 222.

The ranking has a clear limitation. Germany’s leading position rests solely on attacks against Microsoft customers. Attacks on other vendors’ systems are excluded.

What is an AI agent? An AI agent is an AI system that independently plans and executes tasks in multiple steps. Attackers already use these agents, including in the JADEPUFFER ransomware attack, where they automated key parts of the attack chain. For defense, Microsoft recommends giving every agent accessing corporate data a unique digital identity with strictly limited permissions.

Attacks at Machine Speed

JADEPUFFER, a new type of ransomware attack, first appeared in July 2026. AI agents automated key parts of its attack chain. AI agents are AI systems that independently plan and execute multiple tasks. The attack chain covers the steps from initial intrusion to actual damage.

Germany’s ransomware surge comes as vulnerabilities are weaponized faster than companies can fix them. Microsoft puts the median time from discovering a vulnerability to weaponization at well under 24 hours. Companies typically took 30 to 60 days to fix critical, internet-facing vulnerabilities, according to the same findings.

Fully autonomous AI attacks are not yet the norm, according to the same source. In a controlled analysis, however, an AI system completed a 32-stage attack chain. Ralf Wigand, National Security Officer at Microsoft Germany, described overlapping crises and shorter response times for IT security teams.

Data-Stealing Extensions and Shadow AI

Attackers also target browsers. Browser extensions are add-on programs that expand a browser’s functionality. Malicious extensions intercepted chats with AI models such as OpenAI’s ChatGPT or DeepSeek while claiming to support them. They were installed almost 900,000 times and used at more than 20,000 companies.

From 11 to 30 September 2026, Civey conducted an online survey for Microsoft Germany of 750 decision-makers in politics and public administration at federal, state and municipal levels. The findings put shadow AI use in the public sector at 49 percent. This means unauthorized AI models that are neither secure nor compliant with sovereignty requirements. Wigand called employees’ use of freely accessible AI models, for lack of secure alternatives provided by public administrations, a security and sovereignty risk.

Individual Identities for AI Agents

Almost 85 percent of all phishing emails Microsoft examined in the second quarter of 2026 deliberately impersonated others. Phishing refers to fraudulent messages attackers use to steal login credentials or introduce malicious code.

Microsoft recommends two steps against attacks at machine speed. IT security teams should deploy AI agents themselves to detect, investigate and contain threats faster. Every AI agent accessing corporate data should also receive a unique digital identity with strictly limited and controlled access rights.

As worded, the second recommendation applies to every AI agent accessing corporate data. It therefore also covers agents outside the security department. Assigning and controlling these permissions thus extends beyond the security team.

How Respondents Rate Their Cyber Readiness

In the same Civey survey, 64 percent of respondents still rated the current cyberattack threat as high or very high. The share reporting high defensive readiness at their organization rose from under 18 percent a year earlier to more than 44 percent. Both figures come from the same group in which 49 percent in the public sector use shadow AI.

Frequently Asked Questions

Image source: AI-generated (October 2026)

Translated from the German original using artificial intelligence. The German version is authoritative.