Germany recorded over 165 suspected sabotage cases and nearly 750 drone incidents in 2026, confidential BKA report shows
A confidential report by Germany's Federal Criminal Police Office (BKA), cited by Süddeutsche Zeitung and based on the early weeks of the new Joint Centre for Defence against Hybrid Threats (GAZ-Hybrid) in Berlin, documents a sharp rise in suspected sabotage, espionage and suspicious drone activity since the start of 2026. Prosecutors opened 24 espionage cases in the year, about half of them related to cyber operations, and Germany formally holds Russia responsible for an attempted drone attack on a Ukrainian Antonov cargo aircraft at Leipzig/Halle Airport.
Key points
- German law enforcement registered more than 165 suspected sabotage cases since the start of 2026.
- Nearly 750 incidents involving suspicious drones near military and critical-infrastructure sites were recorded in the same period, totaling 1,068 flights.
- Germany's Federal Prosecutor General and state prosecutors opened 24 espionage cases in 2026; about half concern cyber operations and around 40 more are under investigation.
- Police recorded 112 espionage offences overall, with more than 60 involving unauthorized photo or video filming of military objects or equipment.
- In 26 incidents, law enforcement suspects agent activity aimed at preparing sabotage; the highest numbers were in Brandenburg (23), North Rhine-Westphalia and Schleswig-Holstein (21 each), and Lower Saxony (15).
- In July, a Moldovan citizen was detained in Bavaria on suspicion of spying on a KNDS defence facility with a drone; investigators believe he may have acted on Russian intelligence instructions.
- Germany officially holds Russia responsible for the 4 August attempt to blow up a Ukrainian An-124 cargo plane with an explosive drone at Leipzig/Halle Airport.
Why it matters
The figures put a scale on what German officials describe as a sustained campaign of sabotage and espionage against military, defence-industry and critical-infrastructure targets on German soil. Drones are a recurring reconnaissance vector with operators rarely caught, and recent incidents — including an explosive device near a Ukrainian cargo aircraft and a fire on a major western rail line — point to operations German authorities treat as possible Russian sabotage.
What happened
A confidential BKA report, prepared from the first months of operation of the GAZ-Hybrid centre that opened in Berlin in mid-June and reported by Süddeutsche Zeitung, catalogues suspected sabotage, espionage and drone activity in Germany since the start of 2026. It records more than 165 suspected sabotage cases, 112 espionage offences including over 60 cases of unauthorised filming of military sites, 24 opened espionage cases with roughly half related to cyber operations and around 40 further cyber-espionage cases under investigation, and 26 incidents in which agent activity aimed at preparing sabotage is suspected. Security agencies also logged 747 drone incidents involving 1,068 flights over military bases, defence-industry plants and critical infrastructure. Drone operators are rarely apprehended; in July a Moldovan citizen was detained in Bavaria for allegedly spying with a drone on a KNDS facility, with investigators suspecting Russian intelligence involvement. On 9 August near a gas processing plant in Grossenkneten, Lower Saxony, a guard searching for drone operators was attacked by two masked individuals who fled. Earlier cases cited for context include the April 2024 arrest in Bavaria of two dual Russian-German agents allegedly surveilling US bases and aid routes for Ukraine, and the July 2024 DHL parcel fire at Leipzig Airport, which German intelligence attributed to Russia. More recently, a July 2026 fire on the Düsseldorf–Cologne railway damaged signal cables and is being investigated as possible sabotage, and on 4 August an explosive drone was found near a Ukrainian An-124 at Leipzig/Halle Airport, where three drones in total were discovered; evidence at the scene indicated Russia attempted to blow up the aircraft, and Germany has formally attributed the attempt to Russia.
How Ukrainian sources describe it
Ukrainian outlets frame the story around Germany's domestic vulnerability, presenting the BKA figures as evidence of a large-scale sabotage and espionage campaign on German soil. Each headline anchors the threat in Germany ('У Німеччині' / 'В Германии') and treats the confidential BKA report and Süddeutsche Zeitung reporting as the authoritative basis for the claims.
Where reporting differs
Sources broadly agree on the headline figures and on the cases described. One source states the two masked individuals in the 9 August Grossenkneten incident struck the guard's head against the car bonnet, while another reports only that they attacked him and escaped. One Ukrainian article frames the headline around the more than 165 suspected sabotage cases, while another foregrounds the hundreds of suspicious drone incidents.
Background
The figures come from the early operation of GAZ-Hybrid, the Joint Centre for Defence against Hybrid Threats that opened in Berlin in mid-June 2026. The report was prepared by the Federal Criminal Police Office (BKA) and the headline figures were published by Süddeutsche Zeitung. Earlier cases German intelligence has attributed to Russia — the April 2024 detention of dual Russian-German agents surveilling US bases and aid routes for Ukraine, and the July 2024 DHL parcel fire at Leipzig Airport — provide the backdrop for the current assessment. Germany officially holds Russia responsible for the 4 August drone attempt on the Antonov aircraft at Leipzig/Halle Airport.