# Foreign Intelligence Services Escalate Cyber Warfare Against German Economy German businesses are increasingly facing the brunt of sophisticated cyberattacks orchestrated by foreign intelligence services, a recent survey by the **German digital industry association Bitkom** indicates. The findings highlight a concerning trend where state-sponsored actors are becoming a dominant force in the threat landscape. ## A Stark Rise in State-Sponsored Incidents According to **Bitkom**'s survey of 1,003 German companies, nearly four in ten businesses that experienced data theft, industrial espionage, or sabotage over the past year attributed at least one incident to a foreign intelligence service. This figure represents a substantial leap from 28% in the previous year and a mere 7% in 2023, positioning foreign intelligence services as the second-most common source of attacks, trailing only organized crime. **Sinan Selen**, president of Germany's domestic intelligence agency, affirmed this escalation, stating, "Foreign intelligence services have intensified their hybrid activities and are increasingly responsible for attacks on the German economy." The security and defense industry within Germany is identified as a particularly attractive target for these state-backed operations. ## Key Perpetrators: China, Russia, and Iran **China** emerged as the most frequently cited foreign source of attacks, with over half of affected companies tracing at least one incident back to the nation. **Russia** ranked second, while **Iran** has also become a notable player, linked to roughly one in ten incidents. Overall, more than two-thirds of the surveyed companies reported experiencing a successful cyberattack within the last 12 months. ## Economic Toll and Blurred Lines The financial impact of these digital incursions is staggering. **Bitkom** estimates that cyberattacks alone cost German businesses between $186 billion and $240 billion over the past year. This includes expenses related to business interruptions, extensive investigations, recovery efforts, legal disputes, and extortion, alongside lost revenue and competitive advantages. While organized crime remains the primary source of identified attacks, **Bitkom** notes the growing difficulty in distinguishing between criminal groups and state intelligence agencies. **Bitkom** President **Ralf Wintergerst** explained, "The lines between organized crime and intelligence services are blurred in many countries. Intelligence services utilize criminal structures, and conversely, criminals are given free rein as long as they choose their targets in accordance with political directives." ## Common Attack Vectors Ransomware continues to be the most prevalent form of cyberattack, with one in four companies reporting data encryption and demands for payment. Other frequently reported attack vectors include phishing, password attacks, distributed denial-of-service (DDoS) attacks, malware infections, communications interception, and corporate data theft. The repercussions of these cyber incidents often extend beyond the initial target, leading to production outages for business partners and reputational damage for customers. ## Recent High-Profile Incidents Several prominent German organizations have publicly disclosed cyber incidents this year: * In July, discount supermarket giant **Lidl** reported a data breach following unauthorized access to customer information held by one of its IT service providers. * April saw hackers target external billing provider **Unimed**, impacting numerous medical centers across Germany. Several university hospitals subsequently confirmed that patient information had been stolen. * In January, the **Dresden State Art Collections**, one of Europe's oldest museum networks, was hit by a targeted cyberattack that disrupted significant portions of its digital infrastructure.