How are threats to information commonly categorised by their origin?

Split them first into accidental vs. deliberate, then by source: people, organisation, technology, and force majeure.

Accidental / non-deliberate (zufällig):

• Force majeure (höhere Gewalt): storms, fire, water, earthquake, war
• Technical failure: bad maintenance, misconfiguration, buggy software/firmware, undersized systems
• Human error: negligence, indifference, ignorance, gullibility (Fahrlässigkeit, Unwissenheit, Leichtgläubigkeit)
• Organisational weakness: unclear responsibilities, missing processes/strategy, poor awareness, no controls

Deliberate / intentional (vorsätzlich):

• Malware (viruses, worms, trojans), data theft, extortion, espionage, cyberwar, misuse of IT

Why the split matters: it maps directly onto Safety vs. Security — accidental threats are the realm of safety, deliberate ones the realm of security (an adaptive attacker who works around your defences).