Cyber attacks on German firms: 37 per cent attributed to foreign intelligence services
96 per cent of German companies have recently been affected by espionage or sabotage. China and Russia head the list of state-sponsored attackers.
Intelligence agencies and criminals in the sights of German business
Cyber attacks, industrial espionage and sabotage have caused at least 211 billion euros in damage to the German economy in the past year. This emerges from a study presented by Bitkom president Ralf Wintergerst on Wednesday in Berlin together with the Federal Office for the Protection of the Constitution, as reported by the Süddeutsche Zeitung.
"There are two types of companies: those that have been hacked, and those that don't know it yet," Wintergerst said at the presentation. 96 per cent of surveyed companies reported being affected by data theft, espionage or sabotage in the past twelve months – or at least suspecting it. The most frequent form of attack was digital assaults which, according to the study, usually were not isolated incidents but part of broad-based campaigns.
Constitutional Protection president Sinan Selen described this development as disturbing. Recognising attacks is becoming increasingly difficult due to the growing professionalisation of perpetrators. Artificial intelligence, deepfakes, automated calls and phishing emails work in their favour. Selen spoke of a "KI-Booster" for threat attacks on companies.
State actors on the rise
More than one in three affected companies – 37 per cent – was able to trace at least one attack to a foreign intelligence service. In the previous year, this share stood at 28 per cent. More than half of the companies confirmed to be affected (52 per cent) traced at least one attack back to China, closely followed by Russia with 49 per cent. New in the field of economic crime, according to the report, is Iran: whilst four per cent of attacks could be attributed to it in the previous year, this has already risen to nine per cent in 2026.
The total damage sum of at least 211 billion euros is below the previous year's figure of around 289 billion euros – though with caveats. Only 67 per cent of companies could say with certainty that they had been victims of an attack. The study assumes a dark figure and estimates actual damage at up to 270 billion euros, which would correspond to previous year levels. The damage sum includes, amongst other things, costs for legal disputes, extortion and lost sales.
Companies poorly prepared
Despite the growing threat landscape, IT security spending stagnates at many companies. Whilst the majority expects a further increase in attacks, they are worse prepared for it than before. Bitkom president Wintergerst warned: "A successful cyber attack can still spell the end for companies economically."
The outlook for institutional cooperation, however, has improved. In half of attack cases, affected companies are now notified of the incident by authorities. Most recently, the Joint Centre for Defence against Hybrid Threats has begun operations. Constitutional Protection president Selen sees this as progress, but stressed: "We must get ahead of the wave of attacks." The burden of upgrading security measures also lies with the companies themselves.
Source: Süddeutsche Zeitung