The cyber-criminals launched a ''phishing attack'', sending thousands of emails to companies around the world including Australia and New Zealand involved in the European Union's carbon trading network.

The emails claimed online security needed to be upgraded urgently.

They asked companies to re-register their trading details with the German Emissions Trading Authority, which records all carbon credits and transactions for the EU market.

Those who fell for the ploy were directed to a fake emissions registry website with the authority's logo. The scam allowed the cyber-criminals to capture security codes and passwords needed to gain access to company accounts, enabling them to steal carbon permits and resell them through trading accounts registered in Denmark and Britain.

The head of the German Emissions Trading Authority, Hans-Juergen Nantke, said the crime was a highly professional worldwide action involving not just the 27 member nations of the EU but New Zealand and Australia.

''It was not a hacker attack but a phishing action [aimed] at firms participating in emissions trading,'' he said.

Under the EU's carbon cap and trade laws, companies must buy permits to emit greenhouse gases, and those exceeding their capped allowance can buy carbon credits from companies that have cut their emissions. More than 8 million tonnes of carbon emissions worth about $205 billion were traded in Europe last year.

The scam has disrupted carbon trading across Europe, with trading suspended in Belgium, Denmark, Spain, Hungary, Italy, Greece, Romania and Bulgaria. Although permits can still be traded on the European Energy Exchange or through carbon brokers, trading is required under EU law to be registered with the German Emissions Trading Authority.

A spokesman said access to the authority's database to register emissions trading would be barred for at least the rest of this week.