FOREIGN INTELLIGENCE SERVICES INTENSIFY CYBERATTACKS AGAINST GERMAN COMPANIES

BERLIN — Foreign intelligence services are playing a growing role in cyberattacks, industrial espionage, data theft, and sabotage targeting German companies, with China and Russia identified as the leading foreign sources in a new nationwide business survey.

According to Bitkom, 37% of German companies affected by data theft, industrial espionage, or sabotage during the past 12 months said they could attribute at least one incident to a foreign intelligence service. That figure rose from 28% in 2025 and just 7% in 2023.

The findings are based on a representative survey of 1,003 companies in Germany with at least 10 employees and annual revenue of at least €1 million. The survey was conducted between calendar weeks 16 and 23 of 2026.

Foreign intelligence services now rank as the second-most frequently identified attacker category behind organized crime.

Bitkom found that 62% of companies that experienced data theft, industrial espionage, or sabotage attributed at least one incident to organized crime. Foreign intelligence services followed at 37%, ahead of private individuals and current or former employees.

China was the most frequently identified foreign source.

Among companies that definitively experienced data theft, industrial espionage, or sabotage, 52% traced at least one attack to China, up from 46% in 2025. Russia followed at 49%, also up from 46% the previous year. Iran was identified by 9% of companies, compared with 4% in 2025.

Bitkom President Dr. Ralf Wintergerst said foreign intelligence services are operating with greater professionalism and secrecy while artificial intelligence is also expanding the capabilities available to less sophisticated attackers.

Sinan Selen, President of Germany’s domestic intelligence service, the Federal Office for the Protection of the Constitution, said foreign intelligence agencies have intensified hybrid activities against the German economy.

Selen identified the security and defense industry as a particularly attractive target for foreign intelligence operations and said state-backed actors are targeting entire industries, stealing sensitive information, and disrupting normal business activity.

The scale of the threat extends well beyond confirmed espionage cases.

Bitkom found that 96% of surveyed companies either experienced or suspected data theft, industrial espionage, or sabotage during the previous 12 months.

Only 67% said they could definitively confirm an attack, down from 87% the previous year, while the share of companies that suspected an attack but could not prove it increased from 10% to 29%.

That widening uncertainty creates a significant defensive problem because organizations may be compromised without immediately knowing who accessed their systems or what information was taken.

Cyberattacks accounted for 76% of the total financial damage associated with data theft, industrial espionage, and sabotage.

Bitkom estimated total economic losses from those activities at between €211 billion and €270.8 billion, with cyberattacks alone responsible for between €160.4 billion and €205.8 billion.

The findings indicate that Germany’s private sector is facing a threat environment in which cybercrime, state espionage, sabotage, and hybrid operations are becoming more closely interconnected.

The survey also found that 63% of companies observed an increase in cyberattacks during the previous year, while 69% expect attacks to increase further during the next 12 months.

No surveyed company expected cyberattack activity to decline.

Ransomware remained the most common cyberattack causing measurable damage.

Approximately 25% of German companies reported incidents in which attackers encrypted data and demanded payment for restoration.

Other frequently reported attack methods included password attacks, phishing, distributed denial-of-service attacks, malware infections, spoofing, communication interception, and digital theft of business information.

Bitkom also found that the distinction between state-backed activity and conventional cybercrime is becoming harder to define.

Wintergerst said intelligence services in some countries use criminal organizations to support state objectives, while criminal groups may be permitted to operate as long as their targeting aligns with political priorities.

The survey further showed that government agencies are becoming more important in helping companies identify attackers.

Half of the companies that were able to identify the source or perpetrator of an attack said they received assistance or information from government authorities, compared with 35% in 2025 and 24% two years earlier.

Technical evidence remains central to attribution.

Bitkom found that log-file analysis was the most important technical source of evidence, cited by 68% of companies involved in identifying attacks.

Internal investigations, external forensic analysis, attack-pattern recognition, information sharing between companies, and monitoring of criminal forums also contributed to attribution efforts.

China and Russia remain the most frequently identified foreign sources, while Iran is appearing in a growing share of investigations.

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE