Industrial espionage through cyber attacks 

Industrial espionage 4.0: German companies are increasingly falling victim to cyber attacks. 

Cyber attacks on companies are causing record damage in Germany. Data theft, industrial espionage and the sabotage of digital tools cause a total annual loss of over 223 billion euros. This amount of damage has roughly doubled in the last five years (since 2019).

Bitkom study on cyber attacks on German companies

The industry association Bitcom regularly asks German companies about their experiences with cyberattacks. In the Bitkom study in the last quarter of 2021 the following picture emerged:

• 88 % of all companies discovered that they had been attacked online in 2020 and 2021.
• 13 % of the companies surveyed suspect attacks, but do not know for sure.
• The frequency of attacks has risen by almost half since 2019 In a survey in the last quarter of 2019, 75 % of companies stated that they were "certain" or "very likely" to have been attacked.
• 86 % of digital attacks in 2020 and 2021 resulted in damage for the affected companies. In 2016 and 2017, only 43 % of cyberattacks resulted in real damage; in 2019, the figure was 70 %.
• Not only the number, but also the quality and scope of the attacks have increased dramatically. This has resulted in a significantly higher amount of damage (see above).
• Intellectual property such as patents was stolen from 18 % companies (11% more than in 2019), while losses due to blackmail and sabotage of production and information systems quadrupled (+358%). In 63 % of all cases of theft of sensitive data, the attackers spied on digital communication.

Bitkom President Achim Berg pointed out that hackers are now acting much more professionally. They are no longer the former "hobby hackers", but rather well-equipped and technologically adept cyber gangs, some of which are suspected to be supported by state resources (especially from Russia and China).

Attackers' approach

The attacks are by no means based on purely technical hacking. Rather, social engineering plays a very important role. It works by manipulating employees who, when asked, hand over sensitive access data to a supposedly trustworthy contact. The introduction of malware via email attachments plays a secondary role: Here, too, the unsuspecting employees are exploited without contacting them in person or by telephone. They simply trust the content of an email, download an attachment and use it to inject malicious code into the system. Experts point out that codes can now also be placed in the plain text of emails, even if this has rarely happened so far. This means that the system could be attacked even if an employee only opens the email (without an attachment).

Why is industrial espionage so extremely dangerous?

Experts from the BfV (Federal Office for the Protection of the Constitution) point out that industrial espionage and sabotage endanger Germany as a business location. In the meantime, the Office for the Protection of the Constitution is increasingly involved in such cases because a threat to internal security is also recognized. Attackers target employee, customer, technical and financial data, according to BfV experts. Once an attacker is in the system, they can easily access the sensitive information and use it to their own advantage. This gives industrial competitors a competitive advantage, but there are even worse consequences. If a company produces products for critical infrastructure or even for the military, a data leak would jeopardize our physical security in Germany. Since February 24, 2022 (outbreak of war in Ukraine), this must be viewed in a completely new light. However, tapping into patented developments in B2B and B2C product development also causes enormous damage, especially as some attacks go unnoticed for a long time - until a competitor suddenly brings a comparable product onto the market at a lower price because they have stolen the development data and thus saved on development costs. 

Which sectors are particularly affected by industrial espionage?

According to the latest Bitkom analysis, these are:

• Automotive industry
• Mechanical engineering
• Chemical industry 
• Pharmaceutical industry
• Hardware and software manufacturers

Due to their high level of innovation, suppliers of new drive technologies, such as motors, in particular, will have to compete among mechanical engineering companies, Gearbox etc. are particularly well protected against industrial espionage.

Conclusion

Companies must invest in their Digital security invest. This is achieved through qualified specialists, modern security systems and the constant updating of our own software.