German BKA report logs 165 suspected sabotage cases and 750 drone incidents in 2026
A confidential report by Germany's Federal Criminal Police Office (BKA), published by Süddeutsche Zeitung, records more than 165 suspected sabotage cases and nearly 750 suspicious drone incidents across Germany since the start of 2026. The figures, drawn from the early months of the new Joint Centre for Defence against Hybrid Threats (GAZ-Hybrid) in Berlin, underline the scale of suspected Russian-linked activity on German soil.
Key points
- German law enforcement registered more than 165 suspected sabotage cases since the start of 2026.
- Nearly 750 suspicious drone incidents were recorded over military bases and critical infrastructure in the same period, involving 1,068 flights.
- Germany's General Prosecutor and state prosecutors opened 24 criminal cases on espionage suspicions in 2026, with roughly 40 additional cyber-espionage cases under investigation.
- Police recorded 112 espionage-linked offences; more than 60 involved unauthorised photo or video recording of military sites or equipment.
- In 26 cases law enforcement suspects agent activity linked to the preparation of sabotage acts, with the highest numbers in Brandenburg (23), North Rhine-Westphalia (21), Schleswig-Holstein (21) and Lower Saxony (15).
- Drone operators are rarely apprehended; in July a Moldovan citizen was detained in Bavaria for using a drone to spy on a KNDS defence facility, with investigators believing he acted on Russian intelligence instructions.
- Germany officially holds Russia responsible for the 4 August attempted drone attack near a Ukrainian An-124 aircraft at Leipzig/Halle airport.
Why it matters
The leaked BKA figures provide the first quantified overview of suspected sabotage and espionage activity inside Germany in 2026 and link it formally to Russia, following the official attribution of the attempted drone strike on a Ukrainian Antonov at Leipzig/Halle airport. The pattern combines traditional espionage with mass drone overflights of military bases and defence-industry sites, yet operators are rarely caught, raising questions about Berlin's ability to deter and prosecute such acts.
What happened
A confidential BKA report, made public by Süddeutsche Zeitung and based on the early operations of the new Joint Centre for Defence against Hybrid Threats (GAZ-Hybrid) in Berlin, documents more than 165 suspected sabotage cases and 747 suspicious-drone incidents across Germany since the beginning of 2026. The drones together flew 1,068 sorties over critical infrastructure, military bases and defence-industry plants.
Federal and state prosecutors opened 24 criminal cases on espionage suspicions during the year, about half of them cyber-related, with around 40 further cyber-espionage cases under investigation. Police logged 112 espionage offences overall, more than 60 of which involved unauthorised filming of military objects. In 26 cases investigators suspect agent activity tied to the preparation of sabotage. The regions with the highest case counts were Brandenburg (23), North Rhine-Westphalia (21), Schleswig-Holstein (21) and Lower Saxony (15).
Drone operators were rarely detained. In July a Moldovan citizen was arrested in Bavaria for using a drone to spy on a KNDS facility; investigators believe he acted on Russian intelligence instructions. On 9 August, near a gas processing plant in Grossenkneten, Lower Saxony, a guard searching for drone operators was attacked by two masked individuals who escaped. In July 2026 a fire on the railway between Düsseldorf and Cologne, which damaged signal cables, is being treated as possible sabotage. On 4 August an explosive-laden drone was found near a Ukrainian An-124 at Leipzig/Halle airport, three drones in total were discovered in the area, and Germany officially holds Russia responsible for the attempted attack.
How Ukrainian sources describe it
All three Ukrainian sources present the BKA figures as evidence of a sustained Russian hybrid campaign against Germany. They frame the story as a warning about Moscow's activity on NATO and EU territory, and foreground the Ukraine connection by highlighting past cases tied to military aid for Ukraine and the explosive-drone attempt near a Ukrainian Antonov aircraft at Leipzig/Halle.
Where reporting differs
Ukrainian sources diverge on the 9 August Grossenkneten incident: one account says the masked individuals struck the guard's head against the car bonnet, while another reports only that they attacked him and fled. Both versions agree that the perpetrators were not found.
Background
GAZ-Hybrid, the Joint Centre for Defence against Hybrid Threats, began operating in Berlin in mid-June 2026 and produced the underlying data for the BKA report. Germany's federal and state prosecutors opened 24 criminal proceedings on espionage suspicions in 2026, about half of them linked to cyber operations, with roughly 40 more cyber-espionage cases under investigation. Coverage cites several recent high-profile cases: the April 2024 detention in Bavaria of two Russian-German agents surveilling US bases and aid routes to Ukraine; the July 2024 DHL parcel fire at Leipzig airport, which German intelligence attributed to Russia; the July 2026 railway fire between Düsseldorf and Cologne being investigated as possible sabotage; and the 4 August 2026 discovery of explosive drones near a Ukrainian Antonov at Leipzig/Halle airport.