German firms report surge in cyberattacks linked to foreign spies

German companies are increasingly attributing cyberattacks to foreign intelligence services, according to a new study by Bitkom, the country's digital industry association. The survey, released on Wednesday, found that 37% of businesses hit by cyberattacks in the past year linked at least one incident to a foreign intelligence service—up from 28% a year earlier and more than five times the 7% recorded in 2023.

China and Russia were the most commonly suspected sources, with 52% of affected companies tracing an attack to China and 49% to Russia. Iran was also cited, by 9% of firms. All three countries have denied involvement in such activities.

German officials have recently warned of a growing threat from cyber and hybrid attacks. Bitkom noted that organized crime remains the leading source of attacks, affecting 62% of companies, but the line between criminal groups and state intelligence is often blurred. Bitkom President Ralf Wintergerst said intelligence agencies use criminal structures, while criminals may operate freely if they align with political directives.

The study estimates annual damage from data theft, industrial espionage, and sabotage at least €211 billion. It also highlights the growing use of artificial intelligence in attacks, with traditional ransomware declining and AI-enabled methods like deepfakes and robocalls causing more harm. Eight in ten companies expect attackers to increase AI use, and Wintergerst said AI is fundamentally changing the nature of attacks.

Fewer firms now feel very well prepared for cyberattacks—43% versus 50% a year earlier—but the share saying a successful attack could threaten their survival dropped to 45% from 59%. Cybersecurity spending remained steady at 18% of IT budgets. The survey was based on responses from over 1,000 companies.