Merz Warns Europe to Prepare for 'Severe' Russian Hybrid Attacks

BRUSSELS — Friedrich Merz, the leader of Germany's Christian Democratic Union (CDU), has warned that European nations must brace for a wave of "severe hybrid attacks" from Russia. Merz stressed that European governments can no longer treat unconventional tactics as distant possibilities or isolated incidents.

In institutional parlance, a "hybrid attack" is hostilities designed to stay just beneath the threshold of open warfare. Rather than military hardware crossing borders, states face a mix of cyber intrusions targeting power grids, covert sabotage of undersea cables, state-backed disinformation campaigns designed to sway elections, and the strategic manipulation of migration flows. By operating in this grey zone, an adversary seeks to destabilize European societies while maintaining just enough plausible deniability to make a collective response complicated.

For ordinary citizens, grey-zone conflict is rarely theoretical. A cyberattack does not remain a line item in a security budget; it shows up as paralyzed hospital booking systems, delayed rail networks, compromised banking apps, or sudden outages in regional energy infrastructure. Disinformation campaigns aim to erode trust in democratic institutions and deepen domestic political divides.

When political leaders urge Europe to harden its defenses, the practical consequence is a shift in public spending and everyday regulation. Securing energy pipelines, data hubs, and municipal utilities demands significant public investment. For consumers and businesses, that means stricter digital compliance requirements, potential supply disruptions, and higher long-term costs to fortify essential public services against deliberate interference.

Inside the Brussels bubble, warnings about hybrid threats land directly on a historic institutional friction point: national security remains the jealously guarded prerogative of sovereign member states, not the European Commission. While Brussels can issue cybersecurity rules and coordinate shared funds, national capitals retain exclusive control over their intelligence services, police forces, and military assets.

This creates the classic European compromise machine. The Commission routinely urges member states to pool their threat assessments and build joint defensive shields through mechanisms like the EU Hybrid Toolbox—a collection of policy tools designed to coordinate sanctions and counter-measures. Yet national capitals remain notoriously reluctant to share sensitive intelligence with one another, dreading leaks. The outcome is a familiar institutional dance: Brussels attempts to construct a single security shield while twenty-seven national governments hold twenty-seven separate sets of keys.

Following Merz's warning, attention turns to how European capitals translate heightened concern into practical policy. National parliaments will come under pressure to bolster funding for cyber defense units, domestic intelligence agencies, and critical infrastructure protection.

At the EU level, discussions will continue inside the Council of the European Union—where national ministers gather—to refine joint cyber response protocols and crisis management frameworks. As grey-zone incidents persist, member states will face testing decisions on whether to deepen intelligence sharing or maintain their traditional national silos.