The attacks are on the rise

On the night of October 29, 2026, the headquarters of the Swiss arms manufacturer B&T in Thun caught fire (picture). According to the company’s CEO, the damage amounts to between 12 and 20 million francs; the Bern cantonal police suspect arson. This incident is part of a series of arson attacks, including incendiary devices placed outside technology centers in Munich, burning Bundeswehr trucks in civilian workshops, and set-alight cable bridges in Berlin. For executives in the defense and dual-use markets, this raises a sobering question: Who is protecting your facility, and what new obligations are you now facing? SPARTANAT author Jan Hesselbarth explains.

What Happened in Thun

On the night of Thursday, October 29, 2026, the headquarters of B&T AG in the Thun-Allmendingen industrial park caught fire. It took the fire department until mid-morning to bring the flames under control; the top two floors of the fenced-off building wing were severely damaged. No one was injured. The Bern Cantonal Police announced on Friday that arson is the leading theory and appealed for witnesses. Company CEO Karl Brügger estimated the damage to the Swiss tabloid BLICK CH at 12 to 20 million francs and described the scene at the plant by saying it “looked like a war zone.”

Opinions differ regarding the background of the incident. A group from the far-left scene shared a video on social media that allegedly shows the arson attack: two people dressed in black, an ignited incendiary device, and wooden pallets under a shelter. On November 1, 2026, the NZZ classified the case as a targeted act of revenge from the far-left spectrum and pointed out that B&T manufactures rubber bullet launchers used in demonstrations; a video claiming responsibility circulated in France, linking the incident to the youth protests there. The perpetrators have not been officially identified. The investigation is ongoing.

The company itself issued a statement on November 2. In the statement, B&T condemns violence, property damage, and intimidation as means of conflict resolution, mentions threats against management, and concludes with the sentence: “We stand together.” One can read this text as mere rhetoric. One can also read it for what it is: the reaction of a workforce of about 70 people who stood in front of their burned-out workplace that morning.

The Pattern Behind the Isolated Incident

Thun is not a unique case in Switzerland. A rough chronology of the past fourteen months is enough to recognize a pattern.

On the night of September 3, 2026, in Munich, incendiary devices were thrown from a moving car onto a construction site in front of the corporate headquarters of Rohde & Schwarz; a third, unexploded device was defused by special forces from the State Criminal Police Office. Two Bulgarian nationals—a 28-year-old woman and a 38-year-old man—were taken into pretrial detention. The drone manufacturer HELSING is located in the immediate vicinity. The perpetrators have not yet been identified; the Bavarian State Criminal Police Office is investigating a possible political motive.

On the night of September 24, 2026, three trucks belonging to the German Armed Forces caught fire on the cordoned-off factory grounds of MAN Truck & Bus SE in Barleben near Magdeburg, where they were undergoing repairs. The police suspected arson from the outset. Since early October, the State Criminal Police Office has been examining a letter of claim posted online by a far-left extremist group. There have been several similar incidents since 2025, including one in June 2025 in Erfurt, also on an MAN site.

The impact is greatest on the energy supply. Following an arson attack on two power poles on September 9, 2025, in Berlin-Johannisthal, tens of thousands of households and businesses were cut off from the power supply, in some cases until September 11. The letter claiming responsibility named the Adlershof Technology Park as a target and listed IT, robotics, aerospace, AI, and the security and defense industries as sectors represented there. On January 3, 2026, a fire on a cable bridge over the Teltow Canal left 45,000 households and 2,200 businesses without power; for many connections, repairs lasted into the following week. And on October 5, 2026, unknown perpetrators damaged two 110-kV high-voltage cables and several medium-voltage lines by setting fire to old tires under a cable bridge on Boxberger Straße in Marzahn; 19 commercial businesses had to be temporarily disconnected from the regular grid. Investigators deemed the letter of claim, received in mid-October, to be authentic; in it, the authors state that they deliberately interrupted the power supply to several technology companies, some of which manufacture dual-use products.

Added to this is the insider. In early February 2026, the Hamburg State Prosecutor’s Office executed arrest warrants against two men—a 37-year-old Romanian and a 54-year-old Greek—who are alleged to have carried out acts of sabotage on several corvettes intended for the navy while working in the Port of Hamburg; according to the prosecutor’s office, undetected acts could have led to significant damage or, at the very least, delayed their launch. Among other things, 20 kilograms of grit were reportedly found in the engine block of a ship. The question of possible instigators is being investigated.

Two Types of Perpetrators, One Pattern of Damage

To understand the situation, it is helpful to distinguish between the motives, as they require different defensive strategies.

The first scenario involves anti-militarist left-wing extremism. The number of left-wing extremist-motivated crimes rose by 38.9 percent in 2025 to 8,133 offenses, while violent crimes increased by 60.9 percent to 856. The number of individuals with a propensity for violence reached a new high of 11,600. The source is the 2025 Report on the Protection of the Constitution, and thus a government source reporting on its own activities; the survey follows the police classification of politically motivated crime and does not account for unreported cases. Baden-Württemberg estimates the property damage from the attack on ELBIT SYSTEMS in Ulm in September 2025 at around one million euros.

The second scenario is state-sponsored sabotage. The Federal Office for the Protection of the Constitution (BfV) wrote in its security advisory for the business sector dated July 23, 2026, that there is an increased likelihood that companies in the industry will be targeted by espionage and sabotage operations carried out by Russian state agencies or on their behalf. The agency does not rule out targeted attacks against individual employees, particularly at the management level; at the same time, it identifies a high potential for mobilization among left-wing extremists driven by anti-militarism. In early October 2026, Federal Intelligence Service (BND) President Martin Jäger referred to the attempted attack at Leipzig/Halle Airport before the Parliamentary Oversight Committee, while BfV President Sinan Selen spoke of Russia’s willingness to engage in sabotage and homicide.

For your factory gate, this distinction is of secondary importance. A stack of pallets against the facade burns regardless of who sets it on fire. The distinction becomes important again when it comes to personnel selection, contractors, and access rights, because that is where state-directed actors are at work, and that is precisely where the legislature is currently focusing its efforts.

Target selection is based on the product, not the industry classification

Thun deserves special attention in this regard. According to current reports, the attack was triggered by a product intended for police use in another country, not by a defense contract for Ukraine or NATO. Anyone who assesses their risk based on the “defense” category thus systematically underestimates it.

The Berlin claim letters confirm this pattern from the other side: They were addressed to technology clusters and dual-use manufacturers—that is, companies that often describe themselves as civilian technology providers. A sensor manufacturer with a government client, a software company with a demonstrator, a machining firm with a defense technology contract: Any of these companies could be mentioned in a claim letter long before they even consider themselves part of the industry.

The legal framework is evolving faster than the protections

This is a gap you should be aware of.

The KRITIS umbrella law has been in effect since March 17, 2026, and transposes the CER Directive (EU) 2022/2557 into national law. The associated KRITIS Regulation, which sets out sector-specific thresholds, has been available as a draft bill since May 26, 2026; the legislative process had not been completed as of October 2026. The sectoral scope of the CER Directive covers energy, transportation, healthcare, water, digital infrastructure, space, and other essential service sectors. It does not provide for a separate defense industry sector. Consequently, a small-to-medium-sized supplier bears the same risk of attack as a defense-related entity without falling under the government’s resilience framework for critical infrastructure.

The situation is different when it comes to personnel protection against sabotage. The modernization of the Security Clearance Act was announced on January 15, 2026, and has essentially been in effect since January 16, 2026; it clearly shifts responsibility for personnel protection against espionage and sabotage to companies and introduces a reporting obligation under Section 25a of the Security Clearance Act. On October 28, 2026, the Federal Cabinet adopted the revised version of the Security Clearance Determination Ordinance as the Federal Sabotage Protection Ordinance and included additional economic sectors and use cases for critical infrastructure. The ordinance is issued pursuant to Section 34 of the Security Clearance Act (SÜG) without the consent of the Bundesrat and enters into force on the day following its promulgation in the Federal Law Gazette.

What this means in terms of content can so far only be gleaned from the draft bill, because the adopted version had not yet been published as of November 2, 2026. This is a gap in the data, and I am identifying it as such. The draft dated September 1, 2026, covers, among other things, the defense industry (Section 20(2), sentence 1, no. 1) as well as manufacturers of IT security products for the protection of classified information at the VS-VERTRAULICH level or higher (Section 17, no. 2). This may include business units directly involved in the construction, maintenance, or repair of defense vehicles, defense equipment, or naval vessels; in the case of military drones, it may also include units that develop or manufacture flight control systems, sensors, or communication modules.

The implications are operational. An extended security clearance (Ü2) pursuant to Section 9(1)(3) of the Security Clearance Act (SÜG) is generally required, and the affected individual may not be entrusted with security-sensitive activities until this process is completed. Affected companies must appoint a sabotage prevention officer, identify security-sensitive positions, and report these to the competent authority without delay, no later than one year after acquiring this status. A late, incorrect, or incomplete report may be punishable by a fine of up to 50,000 euros. During the Bundestag hearing on the SÜG amendment, it was pointed out that a sabotage protection vetting procedure typically takes five to eight months. Compare that to your project milestones, and you’ll see the risk to your schedule.

Industry identifies the gap elsewhere. On October 12, 2026, Holger Lösch, Deputy Chief Executive Officer of the BDI – Federation of German Industries, stated that while companies are increasingly being informed about threats, there is a lack of common procedures for quickly translating warnings into concrete measures. The BDI represents the interests of industry; calling for government priority is part of its role. However, its description of the transition from warning to action aligns with what I regularly hear in conversations with executive management.

What this means for your company

First: The methods of attack are low-threshold, yet the impact is high. Pallets under a canopy, old tires under a cable bridge, a fence cut through at a workshop site. None of these methods requires specialized knowledge, and none of these targets was a high-security area. The perimeter of your site determines the extent of the damage, not your access control at the main entrance.

Second: The disruption hits you twice. In addition to property damage, there’s the issue of your ability to deliver to the Federal Office for Equipment, Information Technology, and Utilization of the German Armed Forces (BAAINBw) or your general contractor—and for specialized machinery, replacement lead times often exceed what your business interruption coverage provides. The CEO of B&T stated immediately after the fire that the company was insured. Check whether your policy covers politically motivated arson and what liability period has been agreed upon. This is a question for your insurance broker and legal counsel—not an assessment I can make for your specific case.

Third: Obligations apply regardless of coverage. The government is expanding security screening to include your development and administrative functions. This does not establish a right to physical security protection. Together, these factors create a responsibility for management that cannot be delegated to plant security.

Recommendations for Action

1. Initiate a SÜG impact assessment by November 30, 2026. Have products, clients, ongoing tenders, and targeted BSI approvals assessed to determine whether parts of the company should be classified as security-sensitive areas, and appoint a person responsible for sabotage protection. The regulation takes effect the day after its promulgation; the legal assessment of individual cases should be handled by your legal counsel.

2. Conduct a nighttime inspection of the building envelope within 30 days. Walk the premises between 2:00 a.m. and 4:00 a.m., document flammable materials on facades, shelters, and construction sites, and remove them. Include power supply points, cable routes, emergency power systems, and the civilian workshops where your vehicles or assemblies are parked overnight.

3. Review coverage and contracts through the 2026 fiscal year. Clarify coverage for politically motivated arson, the duration of business interruption coverage, and replacement lead times for specialized machinery, and reconcile this with contractual penalties and delivery dates in your defense contracts. At the same time, determine which manufacturing steps could be transferred to a second location within four weeks.

Fourteen months ago, I would have written this text as an exceptional case. Today, it is a chronicle. The people who stood in front of their burned-out factory in Thun build tools for police officers and soldiers—in other words, for people who stand up for us. That their workplace is being set on fire for this purpose is an outrage that our society is only just beginning to grapple with. And while we grapple with it, production either continues—or it simply does not.

JAN HESSELBARTH, as co-founder and managing partner of BRAVO SIX ADVISORY GmbH, is responsible for the defense division and brings over 20 years of operational and strategic leadership experience from the German Armed Forces, federal agencies, and the private sector. As a paratrooper officer and Joint Terminal Attack Controller (JTAC), he was responsible for territorial tasks and host nation support at the Hamburg Regional Command following a deployment in Kunduz, Afghanistan. His consulting portfolio includes NATO missions, programs involving up to 1,000 participants, training contributions for more than 5,000 Bundeswehr personnel, and co-authorship of a nationwide study on maritime security for the Federal Ministry of the Interior—a core topic in the context of KRITIS.

BRAVO SIX ADVISORY online