German Bundestag President Julia Klöckner's Signal messenger account was compromised in a phishing attack attributed to Russian threat actors, amid a wider ongoing campaign targeting German politicians.

Cyber & Information WarfareCyber AttacksData theft / leaks

AggressorDefense

Summary

On April 22, 2026, German Bundestag President Julia Klöckner (CDU) was reported by Der Spiegel to have her Signal messenger account compromised as part of a persistent phishing campaign targeting users of Signal, including high-level German politicians. International intelligence agencies attribute the months-long attack wave to Russian actors. Klöckner's office neither confirmed nor denied the hacking due to security protocols. The Bundestag's top officials reportedly communicate via Signal groups that include CDU members and Chancellor Friedrich Merz. The German Federal Office for the Protection of the Constitution (BfV) has personally briefed Chancellor Merz, whose phone showed no anomalies. The BfV publicly warned parliamentary party leadership and offices about the ongoing campaign, citing that many Signal group chats might be covertly read by attackers and warned of a likely higher number of undisclosed victims. This incident highlights a significant cyber espionage campaign against German political infrastructure, with implications for secure communications.

Classification

Confidence: High

The event explicitly describes an ongoing hostile Russian-led phishing attack compromising German politicians' Signal accounts (including Julia Klöckner's), fulfilling aggressor criteria. The German Federal Office for the Protection of the Constitution's warnings and direct briefings to officials, including Chancellor Merz, constitute defense preparations.

Source URL

https://epochtimes.de/politik/deutschland/bericht-bundestagspraesidentin-kloeckner-von-signal-hack-betroffen-a5468584.html

Open source

Provenance

Publisher: extension
Submitted: Apr 23, 2026, 12:15 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Apr 22, 2026, 00:00 UTC

Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "141820b2-15f9-49ec-a227-bc72427f06de",
  "url": "https://epochtimes.de/politik/deutschland/bericht-bundestagspraesidentin-kloeckner-von-signal-hack-betroffen-a5468584.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Data theft / leaks",
  "country": "Germany",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Signal",
    "Phishing",
    "cyberattacks",
    "russian intelligence operations",
    "German Bundestag",
    "Julia Klöckner",
    "Friedrich Merz",
    "BfV",
    "offensive cyber operations",
    "Political communications"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "Bundestag President Julia Klöckner (CDU) has been targeted in an ongoing phishing campaign compromising Signal messenger accounts used by German politicians. According to Der Spiegel on April 22, 2026, her Signal account was breached by attackers believed to be Russian intelligence services. Klöckner's spokesperson declined to confirm or deny the breach citing security protocols. Signal is reportedly used by members of the CDU presidium and other top officials, including Chancellor Friedrich Merz, who was briefed by BfV personnel and whose device showed no compromise. The Federal Office for the Protection of the Constitution issued warnings to parliamentary factions and party offices about the extensive, nearly unnoticed extraction of data from Signal groups and the growing number of high-profile victims. Due to the nature of the attacks, authorities believe many incidents remain undisclosed.",
  "summary_short": "German Bundestag President Julia Klöckner's Signal messenger account was compromised in a phishing attack attributed to Russian threat actors, amid a wider ongoing campaign targeting German politicians.",
  "summary_extended": "On April 22, 2026, German Bundestag President Julia Klöckner (CDU) was reported by Der Spiegel to have her Signal messenger account compromised as part of a persistent phishing campaign targeting users of Signal, including high-level German politicians. International intelligence agencies attribute the months-long attack wave to Russian actors. Klöckner's office neither confirmed nor denied the hacking due to security protocols. The Bundestag's top officials reportedly communicate via Signal groups that include CDU members and Chancellor Friedrich Merz. The German Federal Office for the Protection of the Constitution (BfV) has personally briefed Chancellor Merz, whose phone showed no anomalies. The BfV publicly warned parliamentary party leadership and offices about the ongoing campaign, citing that many Signal group chats might be covertly read by attackers and warned of a likely higher number of undisclosed victims. This incident highlights a significant cyber espionage campaign against German political infrastructure, with implications for secure communications.",
  "actor_primary": "Russian intelligence services",
  "target_primary": null,
  "location_text": "Germany",
  "location_region": null,
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "DEFENSE_PREP_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The event explicitly describes an ongoing hostile Russian-led phishing attack compromising German politicians' Signal accounts (including Julia Klöckner's), fulfilling aggressor criteria. The German Federal Office for the Protection of the Constitution's warnings and direct briefings to officials, including Chancellor Merz, constitute defense preparations.",
  "event_time_utc": "2026-04-22T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-04-23T12:15:00.034Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "exact",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighIndependence confirmedTime: ExactLocation: Regional

Source reliability

Info credibility

Event time

Apr 22, 2026, 00:00 UTC

Event time confidence

exact

Location

Germany

Primary actor

Russian intelligence services

Country

Germany

Countries

Germany

Tags

Signal, Phishing, cyberattacks, russian intelligence operations, German Bundestag, Julia Klöckner, Friedrich Merz, BfV, offensive cyber operations, Political communications

Nodes

Node 2: 5th Column

Loading signal...

{ "id": "141820b2-15f9-49ec-a227-bc72427f06de", "url": "https://epochtimes.de/politik/deutschland/bericht-bundestagspraesidentin-kloeckner-von-signal-hack-betroffen-a5468584.html", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Data theft / leaks", "country": "Germany", "source_reliability": "B", "info_credibility": "3", "tags": [ "Signal", "Phishing", "cyberattacks", "russian intelligence operations", "German Bundestag", "Julia Klöckner", "Friedrich Merz", "BfV", "offensive cyber operations", "Political communications" ], "nodes": [ "Node 2: 5th Column" ], "countries": [ "Germany" ], "where_text": "Cyberspace", "headline": null, "description": "Bundestag President Julia Klöckner (CDU) has been targeted in an ongoing phishing campaign compromising Signal messenger accounts used by German politicians. According to Der Spiegel on April 22, 2026, her Signal account was breached by attackers believed to be Russian intelligence services. Klöckner's spokesperson declined to confirm or deny the breach citing security protocols. Signal is reportedly used by members of the CDU presidium and other top officials, including Chancellor Friedrich Merz, who was briefed by BfV personnel and whose device showed no compromise. The Federal Office for the Protection of the Constitution issued warnings to parliamentary factions and party offices about the extensive, nearly unnoticed extraction of data from Signal groups and the growing number of high-profile victims. Due to the nature of the attacks, authorities believe many incidents remain undisclosed.", "summary_short": "German Bundestag President Julia Klöckner's Signal messenger account was compromised in a phishing attack attributed to Russian threat actors, amid a wider ongoing campaign targeting German politicians.", "summary_extended": "On April 22, 2026, German Bundestag President Julia Klöckner (CDU) was reported by Der Spiegel to have her Signal messenger account compromised as part of a persistent phishing campaign targeting users of Signal, including high-level German politicians. International intelligence agencies attribute the months-long attack wave to Russian actors. Klöckner's office neither confirmed nor denied the hacking due to security protocols. The Bundestag's top officials reportedly communicate via Signal groups that include CDU members and Chancellor Friedrich Merz. The German Federal Office for the Protection of the Constitution (BfV) has personally briefed Chancellor Merz, whose phone showed no anomalies. The BfV publicly warned parliamentary party leadership and offices about the ongoing campaign, citing that many Signal group chats might be covertly read by attackers and warned of a likely higher number of undisclosed victims. This incident highlights a significant cyber espionage campaign against German political infrastructure, with implications for secure communications.", "actor_primary": "Russian intelligence services", "target_primary": null, "location_text": "Germany", "location_region": null, "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "DEFENSE_PREP_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The event explicitly describes an ongoing hostile Russian-led phishing attack compromising German politicians' Signal accounts (including Julia Klöckner's), fulfilling aggressor criteria. The German Federal Office for the Protection of the Constitution's warnings and direct briefings to officials, including Chancellor Merz, constitute defense preparations.", "event_time_utc": "2026-04-22T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "exact", "created_at": "2026-04-23T12:15:00.034Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "exact", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }