Hospitals in Germany's capital are reporting an increasing number of suspicious incidents, including cyberattacks, drone flights and arson. Experts warn that healthcare facilities are easy targets.

The Berlin Hospital Association (BKG) has issued a warning describing a spate of seemingly "inexplicable incidents" at hospitals and health care facilities in the capital. These range from drone incursions over hospital grounds and cyberattacks to forced entry and arson. The BKG said Germany's security and intelligence services have classified at least some of these attacks as potential acts of hybrid warfare. The protection of health care facilities is "no longer a purely internal matter for hospitals, but a task that must be addressed together with the security services," according to the BKG. 

For security reasons, the BKG told DW that it could not disclose exactly where the incidents it refers to in the statement took place. The "growing hybrid threat" had prompted the BKG to raise awareness among Berlin hospitals to establish effective self-protection, it said. There are more than 80 hospitals in Berlin, including Charite, the largest university hospital in Europe, which offers all-around care and conducts cutting-edge research.

Explosions, arson, cyberattacks 

In November, a powerful explosion severely damaged the Vivantes hospital in southeast Berlin. A few hours later, a fire broke out at the entrance to Charite hospital in the central district of Mitte. In both cases, the incidents damaged areas for the treatment of cancer patients. That prompted the state security services to launch an investigation on suspicion of politically motivated arson.  

Over the summer, it was reported that six separate fires had broken out in the basement of Berlin's Bundeswehrkrankenhaus (BWK) military hospital, also in Mitte. Citing security sources, the BZ newspaper reported that speculation included a possible connection to the treatment of Ukrainian soldiers in the facility. The Federal Office for the Protection of the Constitution (BfV) told DW that it is not currently "observing any increased [hybrid] activities by foreign intelligence services or other agencies of foreign powers in connection with hospitals."  

What is happening on the planet and in each particular city

right now and any future day, you can find out here:

https://ixyt.info/en/Germany/Hamburg-Nord

Paste the desired city into this link!

However, it said hospitals have been targeted by various cybercrime actors in recent years, adding that it is investigating a series of ransomware attacks by suspected Russian cybercrime actors in Germany. 

"There are increasing signs that the line between cyberespionage and cybercrime is becoming increasingly blurred. A direct connection to Russian state agencies cannot usually be clearly proven," the BfV statement said.

Hospitals are easy targets for extortion, violence  

Manuel Atug is the founder of the AG Kritis, an association of experts focused on improving IT security and the resilience of critical infrastructure in Germany. He told DW that hospitals are more likely to be targeted by ransomware gangs who extort money than state-sponsored actors. "It is almost always a question of money. This is very common, but of course, rarely there can also be sabotage or espionage," said Atug. "We have seen hospitals being broken into recently, and there have also been drone flights over hospitals." 

Hospitals have always been targets because they are poorly prepared, largely due to a lack of investment, according to Atug, which affected smaller clinics in particular. "Often also publicly funded hospitals just don't have the money, while others have funds but prefer to invest them in their major profit centers rather than in all facilities," he said. Atug also pointed to a "growing willingness to use violence against those trying to help," which he linked to misinformation spread online.

"That's a general level of aggression that isn't limited to cyberattacks or acts of sabotage, there is a growing willingness to use violence against those who are trying to help," he said. In 2024, 683 cases of violence against firefighters were recorded nationwide, with 1,012 people affected. A total of 2,042 cases were recorded for other rescue workers, according to data from Germany's Federal Criminal Police Office.  On January 27, a suspected arson attack on the Berlin Jewish Hospital left 14 injured. A 71-year-old patient allegedly set fire to an object in his room that spread to a mattress and ignited a blaze. Berlin's State Criminal Police is now investigating in consultation with the security services. 

A recent sabotage of power lines in southwest Berlin at the beginning of the year left around 100,000 people without heating, power and internet for several days in freezing cold temperatures. The left-wing extremist Vulkangruppe ("Volcano Group") claimed responsibility for the attack, however investigations are ongoing.

Long list of security problems  

Felix Neumann, an extremism and counterterrorism expert at the Konrad Adenauer Foundation, a German political foundation affiliated with the ruling center-right Christian Democratic Union (CDU) party, said Germany still had "a lot to do" in terms of protecting critical infrastructure from malign actors. "Things have been done [to protect Germany] but a) too late and b) not enough," he told DW. "Are we set up for the current situation? No, not really. But are there talks and strategies to deal with the current situation? That's for sure." 

The Berlin Hospital Association said Berlin was already moving in the right direction with its Civil Defense of Hospitals Framework Plan (ZVKH) presented in summer 2025. Berlin is the first German state to draw up this type of plan, but Neumann said targeted investments in the structural and technical resilience of the health care system were also essential. In October, the German Hospital Institute and the Institute for Health Care Business published a study into the scale of investment needed to defend German hospitals in different scenarios.

The study identified a long list of security problems, including staff shortages, a lack of cybersecurity and security on the ground, unguarded access points and largely inadequate preparation for potential chemical, biological, nuclear and military threats. Storage capacities for medicine, blood products and emergency power are currently only sufficient for peacetime, the study found. These vulnerabilities also apply to rehab facilities, nursing homes and psychiatric clinics. 

The study estimated that €2.7 billion ($3.2 billion) would be required with additional operating costs of €670 million per year to protect Germany's hospitals from the current threat level of cyberattacks and acts of sabotage. On January 29, the Bundestag passed a new law (the "KRITIS-Dachgesetz") to shore up protection of critical infrastructure, including IT and telecommunications systems, amid an increase in attacks and espionage in Europe.

The law was tightened via a supplementary resolution following the attack on power lines in southwest Berlin. It obligates companies and institutions in strategically important sectors to improve the physical protection of their facilities. Potential attackers should no longer be able to access information on sensitive data and vulnerabilities, for example, the precise route of power lines — a strategy criticized by AG Kritis. In a statement, the Berlin State Department of the Interior told DW that there continues to be a "high level of abstract risk" in Berlin. This was due to both intensified espionage and sabotage activities by foreign intelligence services, in particular Russia and the rising threat of extremist groups.  

"Both anti-constitutional actors and intelligence services are involved in activities aimed at disrupting public order, attacking the state's ability to act, and spreading fear and terror among the people, institutions and companies affected," the statement said.

Author Helen Whittle

Edited by: Rina Goldenberg

Permalink - https://p.dw.com/p/589Ad