The UK and Germany — Europe's two largest economies — are joining forces to find, expose, and disrupt Russian cyber-attacks on both countries. UK Prime Minister Andy Burnham is travelling to Berlin for talks with German Chancellor Friedrich Merz, with both governments citing mounting hybrid-warfare aggression from Moscow as the driving force behind the partnership.
Burnham warned: "Attacks on our infrastructure, our businesses and our democracies are not a distant threat. They reach into people's homes and workplaces." A statement from Downing Street added: "The hybrid threat from our adversaries — especially Russia — extends across Europe and beyond, threatening our collective security."
The Kensington Treaty: a framework for deeper cooperation
The Berlin talks build on the 2025 Kensington Treaty, formally ratified this week, which commits the UK and Germany to closer ties on science, technology, defence, security, and economic growth. The cyber partnership is one of the treaty's most operationally significant early deliverables, giving both intelligence services and national cyber agencies a mandate to coordinate threat intelligence, attribution, and offensive disruption operations against hostile state actors.
The talks are also set to cover broader geopolitical challenges facing Europe, including continued support for Ukraine, responding to instability in the Middle East, and addressing the impact of disruption to critical global trade routes such as the Strait of Hormuz.
The cost of Russian cyber warfare to the UK
Research published this week by Graeme Downie MP puts hard numbers on the damage Russia has already inflicted on the British economy. Russia-originated illegal cyber activity is estimated to have cost the UK £1.5 billion, while physical attacks on critical infrastructure — including sabotage of subsea cables beneath the Atlantic — are priced at up to £500 million. These figures exclude unquantifiable state costs such as additional resilience spending and rising insurance premiums, both of which the government expects to increase as Russia steps up its hybrid-warfare campaign.
The scale of the assault is significant: there have been over 300 Russian-linked cyber incidents in the UK since 2022, and the report estimates that three out of four incidents affecting UK critical national infrastructure are instigated by hostile foreign states. The UK Cyber Security and Resilience Bill, currently making its way through Parliament, is partly a response to this growing threat.
Germany: almost daily attacks on national infrastructure
German intelligence has long warned of Russian cyber aggression, and 2026 has seen that threat escalate from digital networks to physical infrastructure. On 4 and 5 August 2026, drone attacks struck Leipzig/Halle Airport in Saxony. The German government now reports almost daily attacks on the country's national critical infrastructure.
Cyberattacks on security software used by major transport hubs — including Berlin Airport — left passengers and personnel stranded. Deutsche Bahn, Germany's national rail operator, experienced a series of high-level sabotage incidents. Russia and China have increasingly targeted German industry, with both state actors using a mix of espionage, ransomware, and sabotage.
According to Bitkom, the umbrella organisation for Germany's digital economy, cyberattacks are now costing the German economy €289 billion ($339 billion) annually. While roughly 68 per cent of cases are attributed to crime syndicates, half of the companies surveyed said they could trace at least one attack to Russia — a similar number linked incidents to China.
A coordinated European response
The UK-Germany agreement is part of a broader pattern of European nations recognising that national cyber defences are insufficient against state-level adversaries operating at scale. The EU and Ukraine have already moved to deepen cybersecurity cooperation, while the UK and Germany share intelligence through existing Five Eyes and NATO channels. The new bilateral framework is intended to add operational depth — specifically in attributing attacks faster and coordinating disruption campaigns before adversaries can regroup.
The economic case for cooperation is straightforward. The combined toll of Russian cyber activity on the two countries — measured in stolen data, damaged infrastructure, higher premiums, and emergency resilience spending — already runs into the hundreds of billions of euros. With Moscow showing no sign of curtailing its hybrid campaign, the question for both governments is no longer whether to act jointly, but how quickly the new framework can be made operational.
