Russia suspected behind hacker attack on members of the Bundestag

300 accounts affected

Die German federal government goes loud Spiegel assumes that the attack “presumably comes from Russia.” Dutch intelligence services had previously blamed “Russian state actors.” The German security authorities have been warning about waves of attacks on Signal users for a few months.

According to the federal government, the target of the attack was a broad group of people from the political establishment. The federal government does not provide any information on the number of those affected or the identity of others affected. The messages with which the attackers tried to take over the Signal accounts were sent, among others, to the government and parliament, but also to political think tanks, journalists, intelligence service employees and military officers. The mirror spoke of at least 300 affected Signal accountsincluding that of the family minister Katrin Prien (SPD) and President of the Bundestag Julia Klöckner (CDU). The affected devices have now been checked and the data flow has been stopped.

It is unclear what information may have been leaked. So far there is no evidence that the attackers were able to obtain information or break into other IT systems beyond compromising the Signal accounts. In the case of Klöckner, this could include the contact details of the German Chancellor Friedrich Merz (CDU) concern – Klöckner is in a shared chat group with Merz, even if the government usually uses other, specially secured channels for official communication.

Signal appeals “User vigilance”

Signal takes the reports about the takeover of accounts of government representatives and journalists “very seriously,” the messenger provider explained on X. However, Signal’s encryption and infrastructure have not been compromised. The attacks were aimed at tricking users into disclosing information themselves, Signal said, reminding its users that it “never contacts users via in-app messages, SMS or social media to request their verification code or PIN.” Ultimately, only “user vigilance” can help against phishing attempts.