German police are investigating a suspected politically motivated arson attack at a construction site outside the Munich headquarters of Rohde & Schwarz, a defence technology firm whose products include radar systems to detect, track, and jam drones. A 28-year-old Bulgarian woman and a 38-year-old Bulgarian man were arrested at a nearby petrol station in connection with the incident, which was extinguished before causing significant damage and resulted in no injuries.
The attack follows two sabotage attempts on Germany's electricity grid within 24 hours earlier this week - one targeting a substation near the Jaenschwalde power plant in Brandenburg, another targeting a substation in Bergheim, North Rhine-Westphalia. Also this week, Berlin formally attributed a drone attack on a Ukrainian cargo plane at Leipzig/Halle airport in August to Russia - a conclusion that prompted the EU's foreign policy chief Kaja Kallas to say the incident bore "all the hallmarks" of Russian involvement. Russia has denied responsibility. Germany's Interior Minister Alexander Dobrindt has said foreign powers, particularly Russia, may be using left-wing extremist groups as proxies for sabotage, warning that some increasingly echo Russian narratives on Ukraine.
Taken individually, each incident might be attributed to opportunism or domestic extremism. Taken together over seven days - a suspected arson at a counter-drone technology firm, two power grid sabotage attempts, and a formally attributed Russian strike on airport infrastructure - they describe a sustained campaign against German critical infrastructure that German authorities are treating as coordinated hybrid warfare.
The pattern matters for the insurance market because hybrid warfare - state-directed or state-sponsored attacks using deniable proxies, below the threshold of declared armed conflict - creates a coverage question that traditional policy wordings were not designed to answer. A Bulgarian national arrested outside a German defence firm, acting in circumstances where the state link is suspected but unproven, does not fit cleanly within standard war exclusion language. Neither does an attempted drone attack on airport infrastructure attributed by one government to another government but formally denied by the alleged perpetrator. The incident that preceded all of these - the January 2026 arson attack on the Lichterfelde cable bridge in Berlin, which left approximately 45,000 households and 2,200 businesses without power for up to four days in near-freezing temperatures according to CNBC and CBS News citing grid operator Stromnetz Berlin - was claimed by left-wing extremist group Vulkangruppe, whose own relationship to state direction remains under investigation.
For insurers and brokers with European infrastructure exposure, the German incidents crystallise three coverage questions that should be on the agenda at every relevant renewal conversation now.
First: do property and energy policies written for German or European facilities explicitly include or exclude sabotage as a covered cause of loss where state direction is suspected but unproven?
Standard commercial property policies have historically treated sabotage as a covered peril under all-risks wordings, but war exclusions can apply depending on attribution and characterisation. An arson attack by a proxy of a foreign state - suspected but not established - occupies an ambiguous position in most standard wordings. That ambiguity is not academic when a claim is pending.
Second: Pool Re - the UK government-backed terrorism reinsurance scheme established after the 1992 Baltic Exchange bomb - and equivalent European terrorism reinsurance pools will face questions about whether hybrid warfare attacks by state-directed proxies fall within their coverage parameters. Pool Re's scope was last formally reviewed in the context of cyber terrorism; hybrid physical attacks by state proxies represent a further definitional challenge that has not been conclusively resolved.
Third: the target in Thursday's incident is particularly notable for cyber underwriters. Rohde & Schwarz makes electronic systems to detect, track, and jam drones - the very capability being deployed against hybrid attacks on European infrastructure. A defence technology firm producing counter-drone systems is itself a target for the hybrid threat its products defend against. That is not coincidental. For underwriters writing cyber and technology cover for defence and critical infrastructure suppliers, the Rohde & Schwarz incident is a reminder that these companies sit at the intersection of physical and digital threat, and that their insurance programmes should reflect both exposures.
The practical steps are specific. Review war and sabotage definitions in every European infrastructure, energy, and specialist property policy. Check accumulation exposure across German assets - particularly in the energy, transport, and defence technology sectors. Confirm with political risk specialists whether the current incident pattern meets the threshold for any policy notification obligations. And for any client with German or broader European infrastructure exposure, initiate the conversation about whether existing coverage was designed for the threat environment that now exists, rather than the one that existed when those policies were last reviewed.
The Germany incidents are not a prediction. They are evidence of a threat that is already active, already causing losses, and already generating the kind of attribution ambiguity that makes claims difficult and coverage contested.
