“Overall, at least 37% of Exchange servers in Germany (and in many cases also the networks behind them) are severely vulnerable.”
Germany’s BSI counted 45,000 Exchange servers with Outlook Web Access open to the internet. About 12% run Exchange 2010 or 2013, which stopped getting patches in 2020 and 2023. The BSI called the threat level red in 2021 and nothing improved. The list of victims-in-waiting is schools, clinics, doctors, lawyers and local governments, the people least able to run an email server.