The Berlin Hospital Association (BKG) has issued a warning describing a spate of seemingly “inexplicable incidents” at hospitals and healthcare facilities in the capital. These range from drone incursions over hospital grounds and cyberattacks to forced entry and arson.
The BKG says that Germany’s security and intelligence services classify at least some of these attacks as potential acts of hybrid warfare. The protection of healthcare facilities is “no longer a purely internal matter for hospitals, but a task that must be addressed together with the security services,” according to the BKG.
For security reasons, the BKG told DW that it could not disclose exactly where the incidents it refers to in the statement took place. The “growing hybrid threat” had prompted the BKG to raise awareness among Berlin hospitals to establish effective self-protection, it said.
There are more than 80 hospitals in Berlin, including Charité, the largest university hospital in Europe, founded in 1710, which offers all-around care and conducts cutting-edge research.
Berlin hospitals have been treating injured Ukrainians as part of the “Life Bridge Ukraine” projectImage: Sean Gallup/Getty Images
Explosions, arson, cyber attacks
In November, a powerful explosion severely damaged the Vivantes hospital in southeast Berlin. A few hours later, a fire broke out at the entrance to Charité hospital in the central district of Mitte. In both cases, areas for the treatment of cancer patients were affected. That prompted the state security services to launch an investigation on suspicion of politically motivated arson.
Over the summer, it was reported that six separate fires had broken out in the basement of Berlin’s Bundeswehrkrankenhaus (BWK) military hospital, also in Mitte. Citing security sources, the BZ newspaper reported that speculation included a possible connection to the treatment of Ukrainian soldiers in the facility.
The Federal Office for the Protection of the Constitution (BfV) told DW that it is not currently “observing any increased (hybrid) activities by foreign intelligence services or other agencies of foreign powers in connection with hospitals.”
However, it said that hospitals have been targeted by various cybercrime actors in recent years and is investigating a series of ransomware attacks by suspected Russian cybercrime actors in Germany.
“There are increasing signs that the line between cyber espionage and cybercrime is becoming increasingly blurred. A direct connection to Russian state agencies cannot usually be clearly proven,” the BfV statement said.
German companies face rising cybercrime
To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video
Hospitals are easy targets for extortion and violence
Manuel Atug is the founder of the AG Kritis, an association of experts focused on improving IT security and the resilience of critical infrastructure in Germany. He told DW that hospitals are more likely to be targeted by ransomware gangs who extort money than state-sponsored actors.
“It is almost always a question of money. This is very common, but of course, there can also be sabotage or espionage,” Atug said. “We have seen hospitals being broken into recently, and there have also been drone flights over hospitals.”
Hospitals have always been targets because they are poorly prepared, largely due to a lack of investment, according to Atug, which affected smaller clinics in particular.
“Some of the publicly funded hospitals just don’t have the money, while others have funds but prefer to invest them in their major profit centers rather than in all facilities,” he said.
He also pointed to a “growing willingness to use violence against those trying to help,” which he linked to misinformation spread online.
Storage capacities for medicine, blood products and emergency power are currently only sufficient for peacetime, according to a studyImage: picture alliance/ZB
“That’s a general level of aggression that isn’t limited to cyberattacks or acts of sabotage, there is a growing willingness to use violence against those who are trying to help,” Atug told DW.
In 2024, 683 cases of violence against firefighters were recorded nationwide, with a total of 1,012 people affected. A total of 2,042 cases were recorded for other rescue workers, according to data from Germany’s Federal Criminal Police Office (BKA).
On January 27, a suspected arson attack on Berlin’s Jewish Hospital left 14 injured. A 71-year-old patient allegedly set fire to an object in his room that spread to a mattress and ignited a blaze. Berlin’s State Criminal Police (LKA) is now investigating in consultation with the security services.
A recent sabotage of power lines in southwest Berlin at the beginning of this year left around 100,000 people without heating, power and internet for several days in freezing cold temperatures. The left-wing extremist Vulkangruupe (“Volcano Group”) claimed responsibility for the attack.
A long list of security problems still needs investment
Felix Neumann, an extremism and counter-terrorism expert at the Konrad Adenauer Foundation, a German political foundation affiliated with the ruling center-right Christian Democratic Union (CDU) party, said that Germany still had “a lot to do” in terms of protecting critical infrastructure from malign actors.
“Things have been done [to protect Germany] but a) too late and b) not enough,” he told DW. “Are we set up for the current situation? No, not really. But are there talks and strategies to deal with the current situation? That’s for sure.”
The BKG said that Berlin was already moving in the right direction with its Civil Defense of Hospitals Framework Plan (ZVKH) presented in summer 2025 — Berlin is the first German state to draw up this type of plan — but that targeted investments in the structural and technical resilience of the healthcare system were also essential.
In October 2025, the German Hospital Institute (DKI) and the Institute for Health Care Business (HCB) published a study into the scale of investment needed to defend German hospitals in different scenarios.
Can massive state spending turn the German economy around?
To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video
The study identified a long list of security problems, including staff shortages, a lack of cybersecurity and security on the ground, unguarded access points and largely inadequate preparation for potential chemical, biological, nuclear and military threats.
Storage capacities for medicine, blood products and emergency power are currently only sufficient for peacetime, the study found. These vulnerabilities also apply to rehab facilities, nursing homes, and psychiatric clinics.
The study estimated that €2.7 billion ($3.2 billion) would be required with additional operating costs of €670 million per year to protect Germany’s hospitals from the current threat level of cyberattacks and acts of sabotage.
On January 29, the Bundestag passed a new law (the “KRITIS-Dachgesetz”) to shore up protection of critical infrastructure, including IT and telecommunications systems, against the backdrop of an increase in attacks and espionage in Europe.
The law was tightened via a supplementary resolution following the attack on power lines in southwest Berlin. It obligates companies and institutions in strategically important sectors to improve the physical protection of their facilities.
Residents in southwest Berlin were forced into aid stations following an arson attack on power lines in early JanuaryImage: Omer Messinger/AFP/Getty Images
Potential attackers should no longer be able to access information on sensitive data and vulnerabilities, for example, the precise route of power lines.
In a statement, the Berlin State Department of the Interior told DW that there continues to be a “high level of abstract risk” in Berlin. This was due to both intensified espionage and sabotage activities by foreign intelligence services, in particular Russia and the rising threat of extremist groups.
“Both anti-constitutional actors and intelligence services are involved in activities aimed at disrupting public order, attacking the state’s ability to act, and spreading fear and terror among the people, institutions, and companies affected,” the statement said.
Edited by: Rina Goldenberg
While you’re here: Every Tuesday, DW editors round up what is happening in German politics and society. You can sign up here for the weekly email newsletter, Berlin Briefing.
