SecurityNot yet confirmed elsewhere1 publisher3 min readPublished
Nearly four in ten breached German companies now name a foreign intelligence service
German firms' own attribution of attacks to state services has moved from 7% to nearly 40% in two years. That puts nation-state tradecraft on the risk register of any mid-sized manufacturer with a supplier list.
The Watch · Security desk
What happened
- Bitkom surveyed 1,003 German companies with at least 10 employees, and nearly four in ten of those hit by data theft, industrial espionage or sabotage in the past year blamed at least one incident on a foreign intelligence service.
- China was cited most often, with more than half of affected companies tracing at least one attack to it, Russia ranked second, and about one in ten pointed at Iran.
- More than two-thirds of surveyed firms reported a successful cyberattack in the last 12 months, and one in four had data encrypted with a payment demanded to restore access.
- Bitkom put the annual cost of cyberattacks on German business at between $186 billion and $240 billion, counting interruption, investigation, recovery, legal costs, extortion and lost revenue.
- Sinan Selen, president of Germany's domestic intelligence agency, said foreign services have intensified hybrid activity, and named the security and defense industry a particularly attractive target.
Why it matters
- exposure The sample floor is ten employees, so these espionage reports are coming from the German mid-market, which means firms with no threat intelligence function are describing the same adversaries as defense suppliers.
- contradiction Bitkom names organized crime as the top source while stating that the crime-versus-intelligence boundary cannot reliably be drawn, so some of the movement between those two columns is reclassification rather than new activity.
- decision A risk register that now includes state collection changes purchase order: retention length and egress visibility start to compete with restore speed, because interception and quiet data theft are found in logs or not at all.
Attribution is the soft joint in this data. Bitkom asked 1,003 companies who attacked them and reported the answers, and the published account does not describe how any respondent reached the judgment that a foreign intelligence service was involved [1][19]. Bitkom's own president supplies the reason to hold the figure loosely: intelligence services use criminal infrastructure, and criminal crews are left alone where their targets suit political direction [12]. Some of what sits in the organized crime column belongs in the state column, and some state attributions are inference drawn from tradecraft that criminals also use [13].
The shape of the curve is more useful than the top line. The step happened last year. Seven per cent to 28% is a fourfold move; 28% to nearly 40% is about 1.4x, or twelve points [2][3][21]. Across both years the multiple is 5.7x [20]. Read that as one reclassification event followed by a year of confirmation rather than a rate that quadruples again.
Base sizes matter, because percentages of subsets get quoted as percentages of everything. More than two thirds of 1,003 firms reported a successful attack in the past 12 months, so at least 669 companies [1][7][23]. Nearly 40% of that group is roughly 270 [24]. The bases are not identical, since the espionage question was put to firms hit by data theft, industrial espionage or sabotage [2], so 270 is an order of magnitude, not a count.
Ransomware, at one in four firms, tends to report itself the day it happens [9], while collection rarely does. The same respondents listed communications interception and corporate data theft among what they saw [14], and those are found in log retention windows or not at all. That is the practical difference between the two threat models sitting in the same survey: one is a restore-time problem, the other is a dwell-time problem, and only the second one is affected by how long you keep egress records.
Three named German incidents from this year sit in the reporting around the survey. Lidl disclosed a breach in July after attackers reached customer data held by one of its IT service providers [16]. In April, external billing provider Unimed was targeted, and several university hospitals later said patient information had been stolen [17]. In January the Dresden State Art Collections lost large parts of its digital infrastructure to a targeted attack [18]. Two of the three reached the victim through somebody else's estate [25], which is also where Bitkom puts the knock-on damage: production stoppages at business partners, reputational damage to customers [15].
On the money, Bitkom's range is $186bn to $240bn for the year [8]. Midpoint $213bn, spread $54bn, about a quarter of the midpoint [22]. That is a directional figure for a ministry, and one unlikely to hold its shape once a budget committee starts asking where the number came from.
What to watch
- Whether Bitkom's next survey shows the state-attribution share holding near 40% or resuming the 2024 climb.
- Whether Germany's domestic intelligence agency publishes notification counts, which would give the self-reported figure something to be checked against.
- Whether Iran's roughly 10% share of affected companies grows; it is the newest entrant in the German data.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence48
- Adoption55
- Hype gap+22
- Incentives68
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Bitkom's findings are based on a survey of 1,003 German companies with at least 10 employees.
- [2]
Nearly four in 10 German companies hit by data theft, industrial espionage or sabotage over the past year attributed at least one incident to a foreign intelligence service.
- [3]
That figure is up from 28% last year and just 7% in 2023.
- [4]
Foreign intelligence services are now the second-most commonly blamed attackers of German companies, behind only organized crime.
- [5]
China was the most frequently cited foreign source of attacks: more than half of companies that experienced an incident said they traced at least one attack to China, with Russia ranking second.
- [6]
Roughly one in 10 affected companies linked an incident to Iran.
- [7]
More than two-thirds of the surveyed companies said they had experienced a successful cyberattack of some sort in the last 12 months.
- [8]
Bitkom estimated that cyberattacks alone cost German businesses between $186 billion and $240 billion over the past year, including business interruption, investigations, recovery, legal disputes and extortion, plus lost revenue and competitive advantages.
- [9]
Ransomware remained the most common form of attack, with one in four companies reporting that attackers encrypted data and demanded payment to restore access.
- [10]
Sinan Selen, president of Germany's domestic intelligence agency, said foreign intelligence services have intensified their hybrid activities and are increasingly responsible for attacks on the German economy.
ReportedSupportedSource: Sinan Selen, president of Germany's domestic intelligence agencyView cited source - [11]
Selen said Germany's security and defense industry is a particularly attractive target for foreign intelligence agencies.
- [12]
Bitkom President Ralf Wintergerst said the lines between organized crime and intelligence services are blurred in many countries, with intelligence services utilizing criminal structures and criminals given free rein as long as they choose targets in accordance with political directives.
- [13]
Bitkom said the distinction between criminal groups and state intelligence agencies is becoming increasingly difficult to draw.
- [14]
Companies also reported being targeted with phishing, password attacks, distributed denial-of-service attacks, malware infections, communications interception and corporate data theft.
- [15]
The impact of attacks can extend beyond the company initially targeted, causing production outages at business partners or reputational damage for customers.
- [16]
Lidl disclosed in July a data breach after attackers gained access to customer information held by one of its IT service providers.
- [17]
In April, hackers targeted external billing provider Unimed, used by medical centers across Germany, and several university hospitals later said patient information had been stolen.
- [18]
In January, the Dresden State Art Collections was hit by a targeted cyberattack that disrupted large parts of its digital infrastructure.
- [19]
The published account of the survey does not describe the method by which respondents attributed an incident to a foreign intelligence service.
- [20]
The share rising from 7% in 2023 to nearly 40% is a multiple of about 5.7 over two years.
- [21]
The 2023-to-2024 move (7% to 28%) is fourfold, while the following year (28% to nearly 40%) is about 1.4x, a rise of roughly twelve percentage points.
- [22]
The midpoint of Bitkom's cost range is $213bn, and the $54bn spread is about 25% of that midpoint.
- [23]
More than two-thirds of 1,003 surveyed companies means at least about 669 firms reported a successful attack in the past 12 months.
- [24]
Nearly 40% of roughly 669 affected firms is approximately 270 companies, an approximation because the espionage question's base (firms hit by data theft, industrial espionage or sabotage) is not identical to firms reporting any successful cyberattack.
- [25]
Of the three named German incidents this year, two (Lidl and Unimed) reached the affected parties through an external service provider.
Sources
1 independent publisher whose own reporting we read for this story.
- therecord.mediaChinese and Russian spies stepping up cyberattacks, German companies report
1 article · August 27, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- RansomwareFollow
- Fourth-Party Infrastructure RiskFollow
- Threat AttributionFollow
- German Industry SecurityFollow
- Cyber Loss EstimationFollow
- Cyber EspionageFollow