Foreign special services are behind every third cyberattack on businesses in Germany
In Germany, 37 percent of companies that have suffered cyberattacks, espionage or sabotage in the past 12 months attributed at least one attack to foreign intelligence services. The annual cost to businesses from such crimes is estimated at at least 211 billion euros.
Foreign intelligence services are behind one in three cyberattacks on businesses in Germany, the German Federal Association for Cybersecurity (Bitkom) reported in a study published on August 26.
The study surveyed 1,003 German companies with at least 10 employees. According to the data, 37 percent of companies that had experienced cyberattacks, espionage or sabotage in the past 12 months identified at least one crime as being carried out by foreign intelligence services. This figure rose to 28 percent in 2025 and just 7 percent in 2023.
Of the companies that were able to confirm the attack, 52 percent linked it to China. Another 49 percent identified traces leading to Russia. Eastern European countries outside the European Union were cited as the source of the attacks in 34 percent of cases. The US accounted for 27 percent, while EU countries outside Germany accounted for 12 percent. Another 12 percent of the attacks were traced to Germany itself.
Bitcom called Iran a "new and significant player" in the field of economic crime. Nine percent of the affected companies identified traces of Iran in the attacks. At the same time, most of the companies reported that organized criminal groups were behind the attacks against them.
Bitcom CEO Ralph Wintergers noted that in many countries the line between organized crime and intelligence services is becoming increasingly blurred. According to him, intelligence services can use criminal structures, while criminals can be given free rein if they choose targets that suit their political goals.
The study also paid special attention to the use of artificial intelligence in cyberattacks. 82 percent of the companies reported that criminals are increasingly using artificial intelligence to carry out attacks. However, only 31 percent of respondents were confident in this, while 51 percent suspected that AI was being used. 17 percent of companies said they had forensic evidence that AI was being used.
Among the signs indicating the use of AI, the most common was the automatic adaptation of attack attempts, at 53 percent. High-quality fake audio and video were mentioned at 48 percent, high-quality messages and emails at 38 percent, very high frequency of attacks at 34 percent, and deeply personalized content at 28 percent.