Chinese and Russian spies stepping up cyberattacks, German companies report

Foreign intelligence services, particularly those from China and Russia, are increasingly behind cyberattacks on German companies, according to a new survey of the country’s private sector.

Nearly four in 10 German companies hit by data theft, industrial espionage or sabotage over the past year attributed at least one incident to a foreign intelligence service, the German digital industry association Bitkom found.

That figure is up from 28% last year and just 7% in 2023, making foreign intelligence services the second-most commonly blamed attackers of German companies, behind only organized crime. Bitkom's findings are based on a survey of 1,003 German companies with at least 10 employees.

"Foreign intelligence services have intensified their hybrid activities and are increasingly responsible for attacks on the German economy," said Sinan Selen, president of Germany's domestic intelligence agency, at a presentation of the study. 

Germany's security and defense industry is a particularly attractive target for foreign intelligence agencies, Selen added.

China was the most frequently cited foreign source of attacks. More than half of companies that experienced an incident said they had traced at least one attack to China, with Russia ranking second. Iran has also emerged as a significant source of attacks, with roughly one in 10 affected companies linking an incident to the country. More than two-thirds of the surveyed companies said they had experienced a successful cyberattack in the last 12 months of some sort. 

The economic toll of digital attacks is substantial. Bitkom estimated that cyberattacks alone cost German businesses between $186 billion and $240 billion over the past year, including expenses related to business interruptions, investigations, recovery efforts, legal disputes and extortion, as well as lost revenue and competitive advantages.

Organized crime remains the biggest source of attacks identified by German companies, but Bitkom said the distinction between criminal groups and state intelligence agencies is becoming increasingly difficult to draw.

"The lines between organized crime and intelligence services are blurred in many countries," Bitkom President Ralf Wintergerst said. "Intelligence services utilize criminal structures, and conversely, criminals are given free rein as long as they choose their targets in accordance with political directives."

Ransomware remained the most common form of cyberattack, with one in four companies reporting that attackers had encrypted data and demanded payment to restore access.

Companies also reported being targeted with phishing, password attacks, distributed denial-of-service attacks, malware infections, communications interception and corporate data theft.

The impact of cyberattacks can extend beyond the company initially targeted, causing production outages at business partners or reputational damage for customers, the researchers said.

Several prominent German organizations have disclosed cyber incidents this year.

Discount supermarket giant Lidl disclosed in July a data breach after attackers gained access to customer information held by one of its IT service providers.

In April, hackers targeted external billing provider Unimed, which is used by medical centers across Germany. Several university hospitals later said patient information had been stolen in the breach. And in January, the Dresden State Art Collections, one of Europe's oldest museum networks, was hit by a targeted cyberattack that disrupted large parts of its digital infrastructure.