{
  "id": "c4a7c783-0b55-4a83-8ed6-07f8e1b0374b",
  "url": "https://tagesschau.de/investigativ/ndr-wdr/cdu-merz-hackerangriff-china-russland-100.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Data theft / leaks",
  "country": "Germany",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "CDU",
    "cyberattacks",
    "data theft",
    "Chinese state-sponsored hackers",
    "Friedrich Merz",
    "election interference",
    "Germany",
    "2024",
    "Russia",
    "hack and leak",
    "offensive cyber operations",
    "ZEAM taskforce"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": "Chinese state-linked hackers stole CDU emails, including those of leader Merz, in 2024 attack",
  "description": "In the spring of 2024, Chinese state-sponsored hackers exploited the CVE-2024-24919 vulnerability in a security software used by Germany's CDU party, gaining unauthorized access to the Konrad-Adenauer-Haus party headquarters IT systems. The breach went undetected for at least two weeks, during which attackers exfiltrated data including emails and calendar information of CDU leader and chancellor candidate Friedrich Merz. German security agencies BSI and BfV investigated, concluding the attack was a serious espionage operation commissioned by China. Authorities fear stolen emails could be leaked to influence the federal election in February 2025, possibly shared with Russia in a coordinated disinformation campaign. This cyber incident forms part of broader hostile cyber operations against German political parties reportedly involving both Chinese and Russian state actors over recent years.",
  "summary_short": "In spring 2024 Chinese state-linked hackers stole CDU emails including those of party leader Friedrich Merz, raising fears of election interference in Germany's 2025 federal vote.",
  "summary_extended": "In spring 2024 a major cyberattack targeted Germany's CDU party headquarters via a software vulnerability (CVE-2024-24919), allowing Chinese state-sponsored hackers to access internal systems undetected for weeks. Among stolen data were the emails and calendar of CDU chairman and chancellor candidate Friedrich Merz. German security agencies BSI and BfV confirmed the serious espionage and suspect data may have been shared with Russia to influence the upcoming federal election on February 23, 2025. Authorities warn of possible 'hack and leak' operations that could publish sensitive information to destabilize German politics. The incident follows a pattern of cyberattacks against German political parties over recent years, attributed mainly to Russian intelligence services but increasingly involving Chinese actors working jointly with Russia. The federal government has formed a new taskforce (ZEAM) to detect foreign information manipulation but it is still in early stages as the election approaches.",
  "actor_primary": "Chinese state-sponsored hackers",
  "target_primary": null,
  "location_text": "Konrad-Adenauer-Haus, Berlin",
  "location_region": "Berlin",
  "location_coordinates_lat": 52.5215,
  "location_coordinates_lon": 13.3291,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article clearly details a hostile cyber espionage operation by Chinese state-linked hackers targeting Germany's CDU party and its leader Merz, with concerns about election interference and cooperation with Russian actors. BSI and BfV investigations are cited explicitly.",
  "event_time_utc": "2024-03-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T15:07:00.083Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

{
  "id": "c4a7c783-0b55-4a83-8ed6-07f8e1b0374b",
  "url": "https://tagesschau.de/investigativ/ndr-wdr/cdu-merz-hackerangriff-china-russland-100.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Data theft / leaks",
  "country": "Germany",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "CDU",
    "cyberattacks",
    "data theft",
    "Chinese state-sponsored hackers",
    "Friedrich Merz",
    "election interference",
    "Germany",
    "2024",
    "Russia",
    "hack and leak",
    "offensive cyber operations",
    "ZEAM taskforce"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": "Chinese state-linked hackers stole CDU emails, including those of leader Merz, in 2024 attack",
  "description": "In the spring of 2024, Chinese state-sponsored hackers exploited the CVE-2024-24919 vulnerability in a security software used by Germany's CDU party, gaining unauthorized access to the Konrad-Adenauer-Haus party headquarters IT systems. The breach went undetected for at least two weeks, during which attackers exfiltrated data including emails and calendar information of CDU leader and chancellor candidate Friedrich Merz. German security agencies BSI and BfV investigated, concluding the attack was a serious espionage operation commissioned by China. Authorities fear stolen emails could be leaked to influence the federal election in February 2025, possibly shared with Russia in a coordinated disinformation campaign. This cyber incident forms part of broader hostile cyber operations against German political parties reportedly involving both Chinese and Russian state actors over recent years.",
  "summary_short": "In spring 2024 Chinese state-linked hackers stole CDU emails including those of party leader Friedrich Merz, raising fears of election interference in Germany's 2025 federal vote.",
  "summary_extended": "In spring 2024 a major cyberattack targeted Germany's CDU party headquarters via a software vulnerability (CVE-2024-24919), allowing Chinese state-sponsored hackers to access internal systems undetected for weeks. Among stolen data were the emails and calendar of CDU chairman and chancellor candidate Friedrich Merz. German security agencies BSI and BfV confirmed the serious espionage and suspect data may have been shared with Russia to influence the upcoming federal election on February 23, 2025. Authorities warn of possible 'hack and leak' operations that could publish sensitive information to destabilize German politics. The incident follows a pattern of cyberattacks against German political parties over recent years, attributed mainly to Russian intelligence services but increasingly involving Chinese actors working jointly with Russia. The federal government has formed a new taskforce (ZEAM) to detect foreign information manipulation but it is still in early stages as the election approaches.",
  "actor_primary": "Chinese state-sponsored hackers",
  "target_primary": null,
  "location_text": "Konrad-Adenauer-Haus, Berlin",
  "location_region": "Berlin",
  "location_coordinates_lat": 52.5215,
  "location_coordinates_lon": 13.3291,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article clearly details a hostile cyber espionage operation by Chinese state-linked hackers targeting Germany's CDU party and its leader Merz, with concerns about election interference and cooperation with Russian actors. BSI and BfV investigations are cited explicitly.",
  "event_time_utc": "2024-03-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T15:07:00.083Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}