Skip to content

Federal Office for Information Security

Germany's national cybersecurity agency (BSI), setting IT security standards and handling incident response for government and critical infrastructure.

Current stories

buildOne report1 publisher

Grid-tech vendors need a rehearsed CRA reporting process before their SBOMs are due

Grid-tech vendors have had to report actively exploited vulnerabilities and severe incidents under the EU Cyber Resilience Act since 11 September 2026. SBOMs and vulnerability handling become mandatory on 11 December 2027.

Publishers:dev.to

Reality

Evidence62
Adoption
Not scored
Hype gap−5
Incentives
Not scored
Confidence60
securityConfirmed3 publishers

Rhysida gives Berlin seven days before it auctions 5.79TB of city data

Kai Wegner has ruled out paying, which leaves a seven-day clock running on 5.79 terabytes the group says it holds. Two Berlin department networks were already offline for days, and the city still cannot say what was in the files.

Perspective Coverage

3 publishers
Builder
Builder 13%
Operator
Operator 77%
Investor
Investor 10%

Reality

Evidence65
Adoption
Not scored
Hype gap−25
Incentives60
Confidence62
investConfirmed3 publishers

Kiteworks asks customers to power down for nine hours to guard against zero-day attacks

Kiteworks told customers to shut its file-transfer servers for nine hours this weekend after a federal warning. The company says its current release fixes every known flaw, so the outage guards against one it does not know about.

Publishers:einpresswire.com heise.de techcrunch.com

Perspective Coverage

3 publishers
Builder
Builder 12%
Operator
Operator 63%
Investor
Investor 25%

Reality

Evidence60
Adoption50
Hype gap+25
Incentives65
Confidence55
securityOne report1 publisher

Clop's 43-victim batch puts PLM servers, not file transfer, at the centre of mass exploitation

Shell says it is investigating after Clop claimed 89GB of engineering data. It is one of 43 names the gang tied to a single flaw in internet-exposed PTC Windchill and FlexPLM.

Reality

Evidence60
Adoption
Not scored
Hype gap+25
Incentives60
Confidence58
securityConfirmed6 publishers

Extortionists supply the only itemized count of what left Berlin's state network

The Senate says it will not pay and has now dated a second outflow to August 7 through 12. Twenty-two days after that outflow was first reported, it has published nothing for the people whose records went.

Perspective Coverage

6 publishers
Builder
Builder 20%
Operator
Operator 68%
Investor
Investor 12%

Reality

Evidence60
Adoption
Not scored
Hype gap+20
Incentives70
Confidence62
securityConfirmed5 publishers

Seven national cyber agencies reframe post-quantum migration as an economic risk

The G7 Cyber Security Working Group's June call to action says the quantum threat is off the radar and under-resourced at most organizations, and it hands CISOs the wording to fund a cryptographic inventory this cycle.

Perspective Coverage

5 publishers
Builder
Builder 22%
Operator
Operator 55%
Investor
Investor 23%

Reality

Evidence72
Adoption30
Hype gap+10
Incentives60
Confidence68