In the first half of 2026, a Bitdefender analysis recorded 176 German companies publicly claimed as ransomware victims, placing Germany 4th globally, just behind the USA, Canada, and the UK. Monthly incident counts nearly doubled over that period: from 22 in January to 42 in June 2026. The most active group in Germany goes by the name Qilin, and it is specifically targeting manufacturing and construction businesses.
For companies in the Ruhr Area, one of Germany's most densely industrialised regions, this is not an abstract warning. It is an active, ongoing threat with named victims from the very industries that shape the Recklinghausen district and the wider Ruhr economy.
Updated 19 October 2026: This article now also covers the content of the former post "Ransomware protection for small businesses: the key levers".
Disclaimer: This article is for general informational purposes only and does not constitute legal or security advice. Security incidents require professional support. Status: August 2026.
How serious is the situation? Germany's ransomware landscape in H1 2026
The Bitdefender analysis, published on 11 August 2026 at netzpalaver.de, captures only attacks that ransomware groups have publicised on their own leak sites. The actual number of incidents is substantially higher: when ransoms are paid, public disclosure is usually avoided.
Even so, the figures are stark. In the first half of 2026, 4,641 ransomware attacks were publicly claimed worldwide, up from 4,381 in the same period last year. Germany accounts for 176 of those, placing it 4th globally. The trend is not flattening; it is accelerating.
Who is Qilin, and why are manufacturing and construction so exposed?
Qilin operates a ransomware-as-a-service (RaaS) model: the group develops the malware, brokers initial access, and shares ransom payments with affiliate groups. In Germany, Qilin has been the most active ransomware group in 2026 so far, with 30 claimed victims, well ahead of Akira (21) and Safepay (14). Globally, Qilin recorded 1,358 claimed victims, an increase of 443 percent year-over-year, across more than 50 countries.
Manufacturing is the hardest-hit sector in Germany: 46 manufacturing companies were listed as victims in the first five months of 2026 (25.3 percent of all German ransomware incidents). Across the DACH region, construction, technology, finance, and healthcare round out the top targeted sectors.
Recent confirmed victims published by Qilin on its leak site include Clausing Tiefbau (civil engineering, 08 August 2026) and Roth Industries (manufacturing, June 2026). These names represent the industries that form the economic backbone of the Ruhr Area and Recklinghausen district: metalworking, mechanical engineering, civil construction, and logistics.
Why are these sectors particularly vulnerable?
- Operational pressure: Every hour of downtime costs thousands of euros. Attackers factor this in to maximise leverage when demanding ransoms.
- Legacy IT infrastructure: Older, rarely updated systems expose a wide attack surface with known, unpatched vulnerabilities.
- Mixed OT/IT networks: When office IT and production control systems are not properly segmented, ransomware can spread from a compromised office machine to PLCs, SCADA systems, and production machinery, causing damage far beyond data loss.
How does ransomware get into a business?
The leading attack vectors in 2026:
- Infostealers and stolen credentials: Inconspicuous malware silently steals browser passwords, VPN credentials, and stored tokens. The harvested data is sold on underground markets and then used months later to launch targeted ransomware attacks. Roughly one in five Qilin victims had a corporate domain that had previously appeared in infostealer logs.
- Unpatched VPN and remote access systems: Known but unaddressed vulnerabilities in VPN gateways and remote desktop services are a preferred entry point for Qilin and similar groups.
- Phishing: Convincingly crafted emails trick employees into surrendering credentials or opening malicious attachments. Social engineering remains a widespread and inexpensive first-access vector for attackers.
7 immediate actions that make a difference right now
The following priorities are based on BSI recommendations and the CISA Ransomware Guide:
Enforce MFA on all remote access. VPN, RDP, email, and admin interfaces must be protected with multi-factor authentication immediately. Phishing-resistant methods (FIDO2/passkeys) are far superior to SMS-OTP, because SMS codes can be intercepted or redirected via SIM-swapping.
Create offline backups and test restoration regularly. At least one backup copy must be stored offline, disconnected from the network. Critically: run regular restore tests. A backup that fails at recovery time offers no protection at all.
Prioritise patching: VPN gateways and internet-facing systems first. Unpatched VPN endpoints are Qilin's preferred point of entry. The public CISA KEV catalogue (Known Exploited Vulnerabilities) provides a prioritised list of the most urgent vulnerabilities to address.
Segment the network: separate OT and IT. Production and office networks must operate in distinct segments with no unfiltered connections between them. Segmentation stops ransomware from jumping from a compromised office device to industrial control systems.
Harden privileged accounts (least privilege, PAM). Domain admin accounts must not be used for everyday tasks. Privileged access should be managed, logged, and time-limited through a dedicated Privileged Access Management system.
Train employees and schedule phishing simulations. Regular security awareness training and realistic phishing simulations help office and administrative staff recognise suspicious messages and respond correctly.
Create and rehearse an incident response plan. Without practised processes, businesses lose critical hours when an attack occurs. The plan must include offline communication channels, escalation paths, BSI reporting obligations, and contact details for specialised incident response providers.
Small businesses: the key levers by impact
Ransomware no longer hits only large corporations and industrial firms. Small businesses are a popular target because they are often less well protected and more likely to pay in an emergency. One click on the wrong attachment is enough, and the next morning order data, accounting and mail are encrypted. The entry points are the same as above: phishing emails with an attachment or link, open remote access (RDP, VPN without MFA) with weak passwords, and unpatched systems with known vulnerabilities.
If you work without your own production networks and without a large IT department, you do not have to implement all seven actions at once. Sorted by impact, there are five levers:
- MFA everywhere: for email, remote access and admin accounts. That prevents most account takeovers.
- Tested, immutable backups: one copy offline or immutable, otherwise the attacker encrypts the backup along with everything else. Details in Backup strategy for SMBs.
- Patch with a routine: update operating systems, servers and VPN gateways promptly, not "when there's time".
- Train your staff: short, regular phishing training works better than any poster.
- Separate rights and segment networks: not every account needs admin rights, and not every system needs to reach every other.
Four of these cost mainly consistency, not budget.
What to do if you are hit
Immediately isolate affected systems from the network, but do not shut them down in a panic, restart or wipe them, as forensic evidence would be lost. Restore from tested backups; that is exactly why lever 2 above matters so much. Paying the ransom is not a reliable solution: in a significant share of cases, the promised decryption does not work fully, and every payment funds the next wave of attacks. BSI CERT-Bund is available for reports and initial guidance. Companies subject to NIS2 also have a statutory reporting obligation (see NIS2 for SMBs).
Act now, before it is too late
If you are unsure whether your IT infrastructure is adequately protected against current attack methods, get in touch with us. For businesses in the Ruhr Area, the Recklinghausen district, and beyond, we analyse your attack surface, prioritise the right measures, and help you stay operational when it matters most.
Note: The articles on this blog are produced with the help of AI and are editorially reviewed before publication. Editorial responsibility lies with Emre Yurtbay (see the legal notice).