Cybercrime Threatens German Businesses: Hybrid Attacks and Ransom Payments Surge

A recent survey conducted by the Institute of the German Economy (IW) reveals alarming consequences of cybercrime and hybrid attacks on German companies, with a particular emphasis on the increasing political motivations behind these threats and the economic fallout from ransom payments. Nearly 40% of large companies in Germany report significant impacts from hybrid attacks originating abroad, which include disinformation, espionage, sabotage, and cyberattacks. These impacts are especially pronounced in critical infrastructure sectors, such as information and communications where about one-third of companies report attacks, followed by energy and water supply sectors where over a quarter are affected.

The survey, part of the IW Future Panel in summer 2026, also indicates a shift in the nature of cyber incursions—from financial motives to political agendas. The IT industry association Bitkom found that 46% of affected companies could trace these attacks back to state actors based in Russia or China. IW expert Simon Gerards Iglesias highlighted that while companies have improved IT security, they face limitations countering state-sponsored threats and underscored the need for stronger government action and clear responsibilities under the KRITIS framework law to protect critical infrastructure.

Meanwhile, a separate Bitkom survey disclosed that 20% of German companies have paid ransom demands made by cybercriminals, with amounts ranging from €10,000 to over €1 million. For instance, 37% of paying companies transferred between €10,000 and €100,000, while a concerning 4% paid over €1 million. A notable case involved Berlin refusing to pay a ransom of 30 Bitcoins (approx. €2 million) following the theft of 5.7 terabytes of data, which led to the criminals publishing sensitive information including personal records and emergency plans.

Bitkom President Ralf Wintergerst condemned ransom payments, warning that “Every payment funds the next attack,” and stressed that paying ransoms does not guarantee data recovery or prevent further breaches. These developments underscore the urgent need for coordinated defense efforts involving the federal government, states, and businesses to address the growing cyber threats that jeopardize German companies’ operations and public supply systems.