One in three cyberattacks on firms attributed to intelligence services

On 26 August 2026 Bitkom published a press release summarising the findings of its study “Wirtschaftsschutz 2026”, reporting that 37 percent of companies that experienced data theft, industrial espionage or sabotage in the previous twelve months attributed at least one incident to a foreign intelligence service. The press release and the underlying study are publicly available on bitkom.org, and the results were subsequently covered by news agencies and outlets including dpa, Reuters, Handelsblatt and Die Zeit.

Bitkom highlights a notable upward trend: the share of companies making such attributions was 28 percent in 2025 and only seven percent in 2023. The association also presented, for the first time, a broad economic damage corridor for cyber incidents, estimating total economic losses between 211 and 270.8 billion euros. Bitkom explains that the wide range reflects a growing “dark figure” — incidents that go undetected or unreported — and the difficulty of assigning indirect costs precisely.

Several factors help explain why more firms are attributing attacks to foreign intelligence agencies. Operationally, many recent intrusions show increased sophistication: long‑running campaigns that focus on targeted theft of intellectual property or disruption are characteristics often associated with state actors. Geopolitical tensions over critical technologies and supply chains have also increased incentives for state‑level espionage. Bitkom notes these contextual drivers in its analysis.

At the same time, corporate forensic capabilities have improved, meaning that suspicious indicators — such as distinctive tooling, infrastructure reuse, or attacker behavior patterns — are now more often detected and interpreted by defensive teams. However, detection and improved attribution capability at the firm level is not the same as the kind of forensic certainty required in legal proceedings. The Bitkom study records corporate assessments without presenting court‑grade technical evidence or naming specific states.

Attribution remains a contested technical and legal challenge. When companies attribute an intrusion to an intelligence service, they typically rely on patterns of tradecraft, reused infrastructure, malware signatures, or targeting choices. Such indicators can point towards likely state involvement, but they are rarely definitive proof. Bitkom stresses that its figures reflect companies’ perceptions and assessments rather than judicially verified facts.

The study’s damage corridor also reflects uncertainty. Because many incidents are not detected immediately or at all, aggregated cost estimates must account for unobserved cases. This methodology increases transparency about uncertainty, yet it also results in a very wide estimate range, complicating efforts to quantify the precise economic impact of espionage and sabotage on the national economy.

The economic implications are multifaceted. In addition to direct costs related to operational disruption and data loss, firms face reputational damage, contract penalties, litigation costs and significant expenses for incident response and forensic analysis. Bitkom’s aggregated damage corridor aims to capture these varied effects; individual firms, particularly medium‑sized technology suppliers and specialised vendors in critical supply chains, can face existential threats from a single successful campaign.

This vulnerability also affects investment and insurance markets. Many companies report increased spending on cybersecurity, but insurers are responding by tightening coverage or raising premiums for cyber policies, reflecting a reassessment of systemic risks. The rising attribution rate to foreign intelligence services adds a political and strategic dimension to corporate risk management and complicates decisions around disclosure and cooperation with authorities.

The Bitkom report stimulated debate about the appropriate public‑sector response. Germany’s security architecture includes agencies such as the Federal Office for Information Security (BSI), the Federal Office for the Protection of the Constitution (BfV) and the Federal Intelligence Service (BND), each with different mandates. Bitkom calls for closer cooperation between government agencies and the private sector and for clearer incentives for firms to report breaches.

Policy responses are delicate: enhanced reporting obligations could improve situational awareness but might also expose sensitive commercial information. Moreover, attributing incidents to foreign intelligence services creates diplomatic and law‑enforcement challenges: public accusations can have political consequences, while covert activity is difficult to deter solely through sanctions. Bitkom frames its recommendations as strengthening cooperation and resilience rather than prescribing specific punitive state actions.

Key uncertainties persist. The study does not identify which foreign services are responsible for the attributions reported by firms, nor does it claim legal proof of state culpability. Investigations by competent forensic and law‑enforcement authorities remain necessary to reach firm conclusions. Bitkom’s work contributes to understanding the trend and scale of perceived threats, but it also highlights the limits of publicly available corporate data for conclusive attribution.

For businesses, the message is clear: perceived state‑level threat activity has increased, and potential economic damages are substantial. For policymakers, the challenge is to enhance detection and reporting mechanisms, improve public–private cooperation and pursue international dialogue on norms and deterrence — all while navigating the legal and diplomatic complexities intrinsic to state‑linked cyber operations. Bitkom’s findings thus add urgency to debates over resilience and collective response without resolving the deeper question of definitive attribution in individual cases.