The four cases involved “questionable investigative or surveillance activities” with regard to a supervisory board member and a journalist, a shareholder, a person who threatened board members, and a management board member, a bank statement released on Wednesday said.

Two department heads have been fired following an investigation, the bank added.

The incidents dating back to 1998 “raise legal issues such as data protection or privacy concerns,” the bank said.

“In all incidents, the activities arose out of certain mandates performed by external service providers on behalf of the Bank’s Corporate Security Department,” it said.

“The incidents were isolated and no systemic misbehaviour has been found.”

Corporate surveillence of employees and others touches a sensitive nerve in Germany owing to abuses suffered during the Nazi and communist GDR periods.

The report was carried out by law firm Cleary Gottlieb Steen and Hamilton on the bank’s behalf. State prosecutors are now checking whether the evidence warrants a formal investigation.

“All four incidents originated from mandates initiated to achieve legitimate goals, but, during the course of these mandates, the external service providers retained by the bank engaged in questionable activities,” the statement said.

“Deutsche Bank has informed all persons affected by the aforementioned activities (with the exception of the private individual whose whereabouts are unknown) and expressed its sincere regrets.”

Deutsche Bank said that in the first case it had sought to identify “the source of a leak of confidential information to a journalist” to prevent it from happening again.

In the last case, the bank said it had sought to test the protection of a senior director, whom reports identified as chief operating officer Hermann-Josef Lamberti.

According to the Wall Street Journal, detectives tried unsuccessfully to plant a GPS locating device on Lamberti’s car.

Flowers were also sent to his home with a non-functioning microphone hidden among them to see if it would be found, the newspaper said.

In the third case, detectives tried to photograph the person who allegedly threatened board members, but “the person could not be traced,” the bank said.

Finally, the second incident involved a shareholder who had demonstrated “litigious conduct” towards the bank, which in the end could not determine his motivations.

The events revived fresh memories of alleged spying at other German companies, including the national railway Deutsche Bahn and telecommunications giant Deutsche Telekom.