Last year, 87% of companies in Germany experienced attacks, and Russia has matched China's level in this regard.

      According to the industry association Bitkom, approximately 87% of German companies experienced data theft, espionage, or sabotage in the past year, an increase from 81% the previous year, with the resulting damages estimated at €289.2 billion. This year's report introduces a new methodology rather than a new trend, as Bitkom has merged its company survey with insights from Germany’s domestic intelligence agency. This is significant in a country where public sector defense mechanisms are facing ongoing challenges.

      The importance of this combination lies in the difficulty companies face in attributing breaches themselves. Firms typically know they have been compromised, but often lack knowledge regarding the perpetrator. By aligning survey results with state intelligence on active threats, a clearer picture emerges that neither source could provide independently.

      The findings on attribution are particularly noteworthy. Russia and China are each implicated in 46% of the externally attributed incidents, with Russia increasing its share from 39% the previous year, now matching China. Russia's seven-point increase in just one year is a notable shift given the dataset's size. This aligns with a wider European trend of Russian activities transitioning from espionage to disruption, which Dutch authorities have recorded, having seized 800 servers linked to Russian hacking operations.

      Of the total damage, around €202.4 billion is directly attributed to cyberattacks, while the rest pertains to physical theft and sabotage. This overall figure has risen from €267 billion the previous year. It's important to interpret these statistics as estimates rather than definitive accounts, as they stem from self-reported survey data concerning losses that companies may struggle to quantify. These figures also encompass indirect costs, such as reputational damage, which are not typically reflected in corporate financial statements.

      The methodology employed is at least clear. Bitkom Research conducted telephone surveys with companies having a minimum of ten employees and annual revenues of €1 million, making it a reasonable sampling approach for such complex questions.

      However, the rising percentages come with a measurement challenge. Improved detection can lead to an uptick in reported incidents, suggesting that some of the rise from 81% to 87% might indicate companies are simply becoming more aware of ongoing issues rather than experiencing an increase in incidents.

      Approximately 59% of companies reported feeling economically threatened by cyber incidents, a finding that carries significant implications for business. This sentiment indicates that a majority of German firms view this as an existential risk rather than merely an IT challenge, influencing their financial decisions.

      Malware, ransomware, and phishing remain the primary threats, with phishing often providing the entry point. The ongoing prevalence of these tactics is notable, as they are neither new nor ineffective.

      German industry presents a particularly enticing target for specific reasons. The Mittelstand consists of thousands of mid-sized companies that possess world-leading engineering intellectual property, yet their security budgets are often aligned more with their revenue than the value of the information they safeguard.

      Germany has been enhancing its defensive measures, increasing its intelligence service capabilities in response to rising threats from foreign nations, while NATO has simultaneously been establishing cyber partnerships with firms like Microsoft, Palo Alto, and ESET. This partnership reflects a familiar tension, as European institutions bolster their defenses while simultaneously becoming more reliant on American technology providers.

      This ongoing dependency creates a political risk alongside a technical one, and additional research from Bitkom indicates that a significant majority of German companies feel their reliance on U.S. cloud services is excessive.

      The intelligence-sharing aspect is one that other European nations might seek to replicate. While numerous national industry bodies conduct their surveys regarding breaches, few integrate their findings with the existing intelligence on the active campaigns being executed.

      What remains unresolved in the report is how any individual company should alter its approach. Although attribution insights have improved, the reported damages have risen, and the methods of attack remain consistent with those faced by the sector over the past decade.