Data Centres & Telecommunications in Germany

Germany is one of Europe’s major data centre locations. The Bitkom study published in November 2025 identifies around 2,000 data centres with more than 100 kW of connected capacity each.[1] Driven by cloud computing and artificial intelligence, installed capacity reached approximately 2,980 MW in 2025; the study estimated electricity demand for that year at 21.3 billion kilowatt-hours.[2] This infrastructure supports payment systems, government portals, healthcare IT and the control of energy and water networks.

Capacity is notably concentrated. According to the 2025 Bitkom study, the greater Frankfurt area accounts for more than one-third of Germany’s data centre capacity.[3] Short distances, dense interconnection and shared connectivity offer advantages but can also create common dependencies. Telecommunications adds another essential layer: fixed-line and mobile networks, fibre and international submarine cables keep data centres accessible. When connectivity fails, even substantial computing capacity becomes only partially available.

Incidents in recent years illustrate different attack surfaces. In November 2016, an unsuccessful Mirai infection attempt caused routers serving around 900,000 Deutsche Telekom customers to fail.[4] In September 2020, Equinix confirmed a ransomware attack on internal systems; according to the company, its data centres and customer operations remained operational. Media reports attributed the attack to NetWalker and cited a ransom demand of USD 4.5 million.[5] In January 2024, a ransomware attack affected part of a Tietoevry data centre in Sweden and disrupted services for numerous customers, including retailers and universities. Attribution to Akira comes from media reports.[6]

The second attack surface is physical. In October 2022, two data lines used by the GSM-R railway radio system were cut in succession near Herne and in Berlin-Karow. The second line provided redundancy; its loss halted train traffic in northern Germany for around three hours. This does not establish a coordinated attack based on insider knowledge; subsequent investigations called that initial assumption into question.[7] The case nevertheless shows that redundancy only helps while both routes do not fail. In November 2024, the Baltic Sea cables BCS East-West Interlink and C-Lion1 were damaged. Political suspicions of sabotage must be distinguished from a conclusively established cause.[8]

The third attack surface is the supply chain. Following the cyberattack on BITMARCK in April 2023, precautionary system shutdowns caused extensive disruption at connected statutory health insurers. The annual report explicitly distinguishes this incident from unauthorised access to Jira using stolen credentials in January 2023.[9] In July 2024, a faulty CrowdStrike update caused Windows outages worldwide. In Germany, affected organisations included Berlin Brandenburg Airport and the University Hospital Schleswig-Holstein, which cancelled planned operations.[10] Dependence on a shared service provider or software product can affect many organisations simultaneously, even without an attack.

The Uptime Institute’s 2024 survey shows that outages also occur without attackers: 53 per cent of surveyed operators reported an outage at their organisation in the preceding three years. Asked about their most recent impactful incident or outage, 54 per cent of 97 respondents identified power as the primary cause.[11] The March 2021 fire at OVHcloud’s Strasbourg site destroyed SBG2; around 3.6 million websites were temporarily unavailable.[12] Geographically separated recovery and data-backup capabilities are therefore an important part of resilience planning.

Regulatory applicability requires separate assessment of the operator’s role, services, size and any classification as critical infrastructure. Risk management and incident reporting are central obligations for important and particularly important entities covered by Germany’s BSI Act. For significant security incidents, Section 32 BSIG requires an early warning without undue delay and no later than 24 hours after becoming aware of the incident, followed by an incident notification within 72 hours; a final report is generally due no later than one month after that notification.[13]

Public telecommunications networks and publicly available telecommunications services are also subject to the relevant security requirements of the Telecommunications Act. The Federal Network Agency’s security catalogue specifies the basis for the security concept.[14] Physical protection requires an important distinction: the KRITIS umbrella act lists information technology and telecommunications as a sector, but Section 4(2) exempts operators of critical installations in that sector from, among other provisions, Sections 12 to 16 and Section 18. A blanket obligation for data centres and telecommunications operators to undertake risk analysis, prepare resilience plans and report incidents under those provisions would therefore be incorrect. Remaining duties and other applicable frameworks require case-specific assessment.[15]

The Energy Efficiency Act also shapes operations. For data centres within its statutory scope, PUE requirements and energy-reuse obligations differ according to the commissioning date; statutory exceptions apply to waste-heat utilisation. On an accounting basis, renewable energy must cover at least 50 per cent of electricity consumption from 2024 and 100 per cent from 2027.[16] Infrastructure standards include EN 50600 and ISO/IEC 22237. Their classifications must be distinguished from other schemes: TIA-942 uses Rated-1 to Rated-4, whereas Tier I to Tier IV belong to the Uptime Institute’s separate system. These classifications must not be equated.[17] ISO/IEC 27001 complements this with a management framework for information security.

The most difficult risks often lie at the interfaces between cybersecurity, physical security, power supply and external service providers. In the Uptime Institute survey, power was the most frequently cited primary cause of the most recent impactful outage.[11] Identifying common failure modes across normal operation, backup power and recovery is therefore essential. An additional data copy in the same fire compartment does not protect against loss of that compartment.

In telecommunications, risk shifts outward — across wide geographic areas and beneath the water's surface. Fibre routes, cable ducts, and submarine cables cannot realistically be protected end-to-end over large distances; the decisive lever therefore lies in genuine, geographically and physically separated redundancy and in the speed with which a severed route can be detected and rerouted. Overarching all of this is concentration: a small number of major cloud providers, a small number of security software vendors, a small number of exchange points and data centre regions carry the bulk of the digital load. This bundling creates efficiency and simultaneously creates systemic dependency — when a central element fails, many are affected at once. The technical countermeasure is Defence in Depth: layered, mutually independent protective strata on the onion-shell principle, rigorous network segmentation, zone-and-conduit models, and the Zero Trust principle — no implicit trust granted automatically, whether to users, connections, or service providers. Standards such as ISO/IEC 27001 and the EN 50600 family set the technical framework; they support technical design but do not replace the assessment of statutory duties or an integrated security architecture.