German Government Blames Russia for Cyber Attack on SPD in January 2023

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

The German government attributes a January 2023 cyber attack on the SPD party's email accounts to Russia's GRU-affiliated hacker group APT28 and warns of consequences.

In January 2023, hackers targeted email accounts of the Social Democratic Party of Germany (SPD). The German government has officially attributed this cyber attack to the Russian military intelligence service GRU, specifically the APT28 group. Foreign Minister Annalena Baerbock confirmed the attribution during a visit to Australia and announced that consequences would follow but did not specify what these might be. The attack exploited an unknown Microsoft software vulnerability at the time, and data exfiltration from some email mailboxes could not be excluded. The SPD attack is considered part of a larger APT28 campaign targeting government entities and companies in sectors like energy, IT, defense, and aerospace in multiple European countries. NATO has expressed deep concern over growing Russian cyber activities targeting Germany and several other NATO members, describing these as hostile acts including sabotage, cyber disruption, and disinformation. All German intelligence agencies collaborated on the investigation.

Classification

Confidence: High

The article explicitly states that the German government attributes the cyber attack on SPD email accounts to the Russian GRU's hacker group APT28, confirming aggressor status and a concrete hybrid attack incident.

Source URL

https://tagesschau.de/inland/spd-cyberangriff-russland-100.html

Open source

Provenance

Publisher: extension
Submitted: Apr 28, 2026, 13:45 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Jan 1, 2023, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "90653ce3-9a63-4bcb-b5c7-c9d80cdd2811",
  "url": "https://tagesschau.de/inland/spd-cyberangriff-russland-100.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Germany",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "GRU",
    "APT28",
    "Cyber Attack",
    "SPD",
    "Germany",
    "NATO",
    "offensive cyber operations",
    "information operations"
  ],
  "nodes": [],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": "German Government Blames Russia for Cyber Attack on SPD in January 2023",
  "description": "In January 2023, hackers targeted email accounts of the Social Democratic Party of Germany (SPD). The German government has officially attributed this cyber attack to the Russian military intelligence service GRU, specifically the APT28 group. Foreign Minister Annalena Baerbock confirmed the attribution during a visit to Australia and announced that consequences would follow but did not specify what these might be. The attack exploited an unknown Microsoft software vulnerability at the time, and data exfiltration from some email mailboxes could not be excluded. The SPD attack is considered part of a larger APT28 campaign targeting government entities and companies in sectors like energy, IT, defense, and aerospace in multiple European countries. NATO has expressed deep concern over growing Russian cyber activities targeting Germany and several other NATO members, describing these as hostile acts including sabotage, cyber disruption, and disinformation. All German intelligence agencies collaborated on the investigation.",
  "summary_short": "The German government attributes a January 2023 cyber attack on the SPD party's email accounts to Russia's GRU-affiliated hacker group APT28 and warns of consequences.",
  "summary_extended": null,
  "actor_primary": "APT28",
  "target_primary": null,
  "location_text": "Berlin",
  "location_region": null,
  "location_coordinates_lat": 52.52,
  "location_coordinates_lon": 13.405,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly states that the German government attributes the cyber attack on SPD email accounts to the Russian GRU's hacker group APT28, confirming aggressor status and a concrete hybrid attack incident.",
  "event_time_utc": "2023-01-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T13:45:00.559Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Approximate

Source reliability

Info credibility

Event time

Jan 1, 2023, 00:00 UTC

Event time confidence

pm24h

Location

Berlin

Primary actor

APT28

Country

Germany

Countries

Germany

Tags

Russia, GRU, APT28, Cyber Attack, SPD, Germany, NATO, offensive cyber operations, information operations

Loading signal...

{ "id": "90653ce3-9a63-4bcb-b5c7-c9d80cdd2811", "url": "https://tagesschau.de/inland/spd-cyberangriff-russland-100.html", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Germany", "source_reliability": "B", "info_credibility": "3", "tags": [ "Russia", "GRU", "APT28", "Cyber Attack", "SPD", "Germany", "NATO", "offensive cyber operations", "information operations" ], "nodes": [], "countries": [ "Germany" ], "where_text": "Cyberspace", "headline": "German Government Blames Russia for Cyber Attack on SPD in January 2023", "description": "In January 2023, hackers targeted email accounts of the Social Democratic Party of Germany (SPD). The German government has officially attributed this cyber attack to the Russian military intelligence service GRU, specifically the APT28 group. Foreign Minister Annalena Baerbock confirmed the attribution during a visit to Australia and announced that consequences would follow but did not specify what these might be. The attack exploited an unknown Microsoft software vulnerability at the time, and data exfiltration from some email mailboxes could not be excluded. The SPD attack is considered part of a larger APT28 campaign targeting government entities and companies in sectors like energy, IT, defense, and aerospace in multiple European countries. NATO has expressed deep concern over growing Russian cyber activities targeting Germany and several other NATO members, describing these as hostile acts including sabotage, cyber disruption, and disinformation. All German intelligence agencies collaborated on the investigation.", "summary_short": "The German government attributes a January 2023 cyber attack on the SPD party's email accounts to Russia's GRU-affiliated hacker group APT28 and warns of consequences.", "summary_extended": null, "actor_primary": "APT28", "target_primary": null, "location_text": "Berlin", "location_region": null, "location_coordinates_lat": 52.52, "location_coordinates_lon": 13.405, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article explicitly states that the German government attributes the cyber attack on SPD email accounts to the Russian GRU's hacker group APT28, confirming aggressor status and a concrete hybrid attack incident.", "event_time_utc": "2023-01-01T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-04-28T13:45:00.559Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }