German government sees Russia behind attack on Signal accounts including ministers Prien and Hubertz

Cyber & Information WarfareCyber AttacksData theft / leaks

Aggressor

Summary

Germany's government confirms that Russian-backed phishing attacks have compromised Signal messenger accounts of ministers Prien and Hubertz and at least 300 political users.

A large-scale phishing campaign targeting Signal messenger accounts has compromised those of several German government members, including BAuministerin Verena Hubertz (SPD) and Familienministerin Karin Prien (CDU). The German government attributes the attacks primarily to Russian actors. At least 300 Signal accounts from politicians, officials, diplomats, military personnel, and journalists have been attacked. The attacks exploit human vulnerabilities via phishing to steal PINs or access through fake 'Signal-Support' messages. The German Federal Prosecutor is investigating the campaign under suspicion of espionage. Dutch authorities have made similar assessments linking Russia to these attacks. Signal’s end-to-end encryption remains secure, but the attackers gain access by targeting users directly. Authorities are increasingly warning the public about these threats, though experts claim responses have been delayed historically. Bundestagspräsidentin Julia Klöckner’s Signal account was also reportedly targeted, highlighting the reach of the campaign into high government echelons.

Classification

Confidence: High

The article explicitly details a discrete cyber espionage campaign against German government officials' Signal accounts attributed to Russian actors, with investigation underway by German authorities.

Source URL

https://tagesspiegel.de/politik/offenbar-auch-prien-und-hubertz-betroffen-regierung-sieht-russland-hinter-attacke-auf-signal-konten-15521758.html

Open source

Provenance

Publisher: extension
Submitted: Apr 25, 2026, 14:35 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Jun 6, 2024, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "b935dc34-9c9b-4a3c-90a0-757746a55125",
  "url": "https://tagesspiegel.de/politik/offenbar-auch-prien-und-hubertz-betroffen-regierung-sieht-russland-hinter-attacke-auf-signal-konten-15521758.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Data theft / leaks",
  "country": "Germany",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Signal phishing",
    "Russian cyber espionage",
    "German government",
    "Cyber attack",
    "Data theft",
    "Espionage investigation",
    "Political targets"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": "German government sees Russia behind attack on Signal accounts including ministers Prien and Hubertz",
  "description": "A sophisticated phishing campaign targeting Signal messenger users in Germany, including cabinet ministers Verena Hubertz (SPD) and Karin Prien (CDU), has been attributed to Russian actors by the German government and security experts. At least 300 political and governmental Signal accounts have been compromised, exposing chats and allowing attackers to impersonate users in group chats. The attacks exploit phishing tactics asking targets to input PINs or scan QR codes imitating Signal support, enabling access despite Signal's strong end-to-end encryption. German Federal Prosecutor Jens Rommel is investigating for espionage. Similar attacks have been reported in the Netherlands, also linked to Russia. Authorities warn the public and officials about these persistent intrusions. High-level politicians affected include Bundestagspräsidentin Julia Klöckner, underscoring the attack’s broad political reach.",
  "summary_short": "Germany's government confirms that Russian-backed phishing attacks have compromised Signal messenger accounts of ministers Prien and Hubertz and at least 300 political users.",
  "summary_extended": "A large-scale phishing campaign targeting Signal messenger accounts has compromised those of several German government members, including BAuministerin Verena Hubertz (SPD) and Familienministerin Karin Prien (CDU). The German government attributes the attacks primarily to Russian actors. At least 300 Signal accounts from politicians, officials, diplomats, military personnel, and journalists have been attacked. The attacks exploit human vulnerabilities via phishing to steal PINs or access through fake 'Signal-Support' messages. The German Federal Prosecutor is investigating the campaign under suspicion of espionage. Dutch authorities have made similar assessments linking Russia to these attacks. Signal’s end-to-end encryption remains secure, but the attackers gain access by targeting users directly. Authorities are increasingly warning the public about these threats, though experts claim responses have been delayed historically. Bundestagspräsidentin Julia Klöckner’s Signal account was also reportedly targeted, highlighting the reach of the campaign into high government echelons.",
  "actor_primary": "Russian actors",
  "target_primary": null,
  "location_text": "Germany",
  "location_region": null,
  "location_coordinates_lat": 51.1657,
  "location_coordinates_lon": 10.4515,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly details a discrete cyber espionage campaign against German government officials' Signal accounts attributed to Russian actors, with investigation underway by German authorities.",
  "event_time_utc": "2024-06-06T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-25T14:35:00.051Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighIndependence confirmedTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Jun 6, 2024, 00:00 UTC

Event time confidence

pm24h

Location

Germany

Primary actor

Russian actors

Country

Germany

Countries

Germany

Tags

Signal phishing, Russian cyber espionage, German government, Cyber attack, Data theft, Espionage investigation, Political targets

Nodes

Node 2: 5th Column

Loading signal...

{ "id": "b935dc34-9c9b-4a3c-90a0-757746a55125", "url": "https://tagesspiegel.de/politik/offenbar-auch-prien-und-hubertz-betroffen-regierung-sieht-russland-hinter-attacke-auf-signal-konten-15521758.html", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Data theft / leaks", "country": "Germany", "source_reliability": "B", "info_credibility": "3", "tags": [ "Signal phishing", "Russian cyber espionage", "German government", "Cyber attack", "Data theft", "Espionage investigation", "Political targets" ], "nodes": [ "Node 2: 5th Column" ], "countries": [ "Germany" ], "where_text": "Cyberspace", "headline": "German government sees Russia behind attack on Signal accounts including ministers Prien and Hubertz", "description": "A sophisticated phishing campaign targeting Signal messenger users in Germany, including cabinet ministers Verena Hubertz (SPD) and Karin Prien (CDU), has been attributed to Russian actors by the German government and security experts. At least 300 political and governmental Signal accounts have been compromised, exposing chats and allowing attackers to impersonate users in group chats. The attacks exploit phishing tactics asking targets to input PINs or scan QR codes imitating Signal support, enabling access despite Signal's strong end-to-end encryption. German Federal Prosecutor Jens Rommel is investigating for espionage. Similar attacks have been reported in the Netherlands, also linked to Russia. Authorities warn the public and officials about these persistent intrusions. High-level politicians affected include Bundestagspräsidentin Julia Klöckner, underscoring the attack’s broad political reach.", "summary_short": "Germany's government confirms that Russian-backed phishing attacks have compromised Signal messenger accounts of ministers Prien and Hubertz and at least 300 political users.", "summary_extended": "A large-scale phishing campaign targeting Signal messenger accounts has compromised those of several German government members, including BAuministerin Verena Hubertz (SPD) and Familienministerin Karin Prien (CDU). The German government attributes the attacks primarily to Russian actors. At least 300 Signal accounts from politicians, officials, diplomats, military personnel, and journalists have been attacked. The attacks exploit human vulnerabilities via phishing to steal PINs or access through fake 'Signal-Support' messages. The German Federal Prosecutor is investigating the campaign under suspicion of espionage. Dutch authorities have made similar assessments linking Russia to these attacks. Signal’s end-to-end encryption remains secure, but the attackers gain access by targeting users directly. Authorities are increasingly warning the public about these threats, though experts claim responses have been delayed historically. Bundestagspräsidentin Julia Klöckner’s Signal account was also reportedly targeted, highlighting the reach of the campaign into high government echelons.", "actor_primary": "Russian actors", "target_primary": null, "location_text": "Germany", "location_region": null, "location_coordinates_lat": 51.1657, "location_coordinates_lon": 10.4515, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article explicitly details a discrete cyber espionage campaign against German government officials' Signal accounts attributed to Russian actors, with investigation underway by German authorities.", "event_time_utc": "2024-06-06T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-04-25T14:35:00.051Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }