Germany's security services are grappling with a sudden surge in suspected hybrid attacks and infrastructure sabotage, with federal authorities logging 165 cases so far in 2026. The situation has intensified rapidly following formal declarations by federal ministers that the nation has become a daily target of hostile foreign operations.
On Tuesday, the German government took the significant step of formally blaming Russia for an attempted hybrid attack involving an explosive-laden drone at the Leipzig/Halle airport on August 4th. Citing evidence from an official investigation, Interior Minister Alexander Dobrindt stated, 'the government concludes that Russia is responsible for the hybrid attack in Leipzig on August 4th.' Dobrindt emphasized that the incident was not isolated but belonged to an ongoing series of hybrid attacks orchestrated by Russia and carried out by 'low-level agents.' He concluded, 'We are not at war, but we are a daily target of hybrid warfare.' This marked a major shift for Berlin, which had previously avoided directly naming Russia for recent drone incursions and infrastructure interference, often attributing them vaguely to 'foreign powers.'
Following the formal attribution, Foreign Minister Johann Wadephul announced immediate diplomatic and security countermeasures. Germany is tightening entry controls for Russian nationals, closing the Russian consulate in Bonn, and terminating the contract for the Russian House cultural center in Berlin. Russia dismissed the accusations as 'absurd' and warned of impending 'consequences.'
Concurrently, a series of suspected sabotage acts targeted Germany's critical infrastructure. On Tuesday, an arson attack using improvised explosive devices targeted the Jänschwalde coal-fired power plant in Brandenburg. Another incident occurred in Bergheim, North Rhine-Westphalia, where perpetrators targeted overhead power lines. Although major power outages were avoided in both instances, investigators recovered incendiary devices and conductive materials at the scenes.
The disruption continued early Wednesday morning when an explosion rocked a pedestrian passage at Augsburg's central train station. The blast left two people suffering from blast trauma and halted rail traffic for several hours as police investigated a suspicious package. On Thursday, an arson attack hit a construction site in Munich. Because the site was linked to a defense firm, Bavaria's State Criminal Police Office (LKA) took over the investigation. Meanwhile, in Berlin, Terminal 1 at BER airport was evacuated for several hours overnight from Thursday to Friday after a woman claimed to have a dangerous substance in her bag. Police are still evaluating whether this was an act of sabotage.
By Friday morning, additional investigations were underway in North Rhine-Westphalia, where police suspected sabotage attempts at energy substations in Dormhagen and near Aachen in Weisweiler. A device was discovered at the Dormhagen site, though no damage occurred, and police received a letter claiming responsibility for the incident in Weisweiler.
Federal Criminal Police (BKA) data analyzed in a joint report by Süddeutsche Zeitung, NDR, and WDR revealed that federal and state security agencies have logged 165 suspected sabotage cases in 2026, primarily concentrated in Lower Saxony, North Rhine-Westphalia, and Bavaria. This follows a total of 320 suspected cases recorded in 2025. Commenting on the Bergheim incident, North Rhine-Westphalia's Interior Minister Herbert Reul warned that 'more sabotage, more hybrid attacks [are] happening right on our doorstep,' adding that the perpetrators are 'trying to hit our country.'
Tensions between Germany and Russia have reached levels unseen since the Cold War. Germany has been Ukraine's largest military supporter since late 2025, giving Moscow a clear motive for retaliation. However, direct military action risks triggering a conflict with NATO, leading to 'gray zone' tactics that fall below the threshold of open warfare. These tactics include cyberattacks, airspace violations, drone flights near sensitive sites, and suspected assassination plots, all of which Russia denies. Regarding the Leipzig airport incident, German prosecutors have identified two suspects holding Russian passports based on DNA evidence. For the other recent incidents, investigations remain ongoing. Andrei Soldatov, a London-based expert on Russian security services, noted that the West's current strategies are outdated, stating, 'We need to accept that we are facing a long hybrid war' where Cold War-era solutions will not suffice. Similar alarms over sabotage have also been raised by intelligence agencies in Denmark and France.
