Report: seven members of Germany's Bundestag and 31 members of its state parliaments were targeted in a phishing attack allegedly originating from Russia's GRU
At least seven members of Germany's Bundestag and 31 members of the state parliament have been targeted by a hack that is believed …
Context & Ripple Effects
This phishing campaign fits a decade-long arc of Russian operations against German political institutions: after the 2015 Bundestag breach that siphoned large volumes of parliamentary data, sources pointed to APT28 malware lingering up to a year inside government computers in the 2018 government-network infiltration.
The response has escalated too — the EU sanctioned the GRU and two of its officers over the 2015 hack in October 2020, months before this report — and Berlin again blamed Russian state hackers when Fancy Bear was tied to the takedown of several government websites in the May 2024 attribution. Moving from network breaches to phishing individual lawmakers marks a shift toward the people rather than the infrastructure.
First-order effects
- Thirty-eight named parliamentarians — seven federal, thirty-one state-level — must treat their personal email accounts and devices as compromised attack surface, pushing security reviews into politicians' private communications rather than just official systems.
Second-order effects
- Germany's domestic intelligence apparatus, which already documented the 2015 data theft and explored offensive legal options, gains fresh evidence to argue for expanded counterintelligence mandates over MPs' communications.
- The EU's precedent of sanctioning the GRU directly gives Brussels and Berlin a ready-made retaliation instrument if attribution firms up beyond 'allegedly.'
Third-order effects
- If the pattern holds, defending elected officials becomes a standing cybersecurity category distinct from agency network defense — with parliaments funding per-member protection as routine infrastructure rather than incident response.
The trend: Russian state cyber operations against German democratic institutions are persisting and shifting targets across a decade of attributions and sanctions, from parliament networks to individual lawmakers.