Vast breach exposes German politicians’ personal data
A sweeping data breach has exposed information on hundreds of German politicians and public figures, including Chancellor Angela Merkel, a German government spokeswoman has confirmed.
“Personal data and documents belonging to hundreds of politicians and public figures have been published online,” German government spokeswoman Martina Fietz said at Friday press conference.
Every party in German parliament aside from the far-right Alternative for Germany was affected by the breach, with hundreds of mobile phone numbers and addresses of politicians and public figures dumped on Twitter, German news outlet RBB reported. In some cases, private chats and credit card information were included, the report said.
But in Merkel’s case, the information exposed was less sensitive and included two email addresses, according to German media reports.
“The information and data drained from the chancellery and that relate to the chancellor are manageable,” Fietz said.
It is unclear who is responsible for the breach and whether it occurred via a hack or by other means. The perpetrators have leaked the data on Twitter according to a set schedule in recent weeks. The information doesn’t stem from a single source, but rather a mix of public and private data, German newspaper Der Spiegel reported. Some of the information is several years old.
A security researcher known as the grugq said the data posted to Twitter was resilient to being taken offline, with redundant links, to the point that it “must have required many man hours of uploading.”
By Friday, Twitter had suspended the account that published the leaked data.
German Justice Minister Katarina Barley condemned “a serious attack on the right to privacy and thus a cornerstone of our democracy.”
Barley said the perpetrators “want to damage confidence in our democracy and its institutions,” and called for them to be held accountable.
‘Soft underbelly’ of democracy targeted
While it is unclear if hacking was the cause of the latest breach, the fact that hackers have targeted German government officials before has made data security a critical national issue. For example, suspected Russian government-linked hackers have reportedly breached the networks of the German Parliament and the country’s defense and foreign ministries.
Faced with these threats, German government officials in August announced a new €200-million research agency, modeled after the Pentagon’s research arm, to boost cyberdefenses.
Germany’s Interior Ministry did not respond to requests for comment on the latest data breach. The country’s Federal Office of Information Security (BSI) tweeted that it was investigating the incident and there appeared to be no threat to government networks.
“Compared to previous, more clandestine cyber operations targeting Germany’s political landscape, this [incident] looks like an attempt to disrupt politics and discredit politicians and parties,” Sven Herpig, a cybersecurity expert with the German think tank SNV, told CyberScoop.
“It seems like this time malicious actors also hit the soft underbelly of Germany’s democracy – the individual politicians and the parties outside of the secured government networks,” added Herpig, a former official at BSI, which has a similar cybersecurity mandate to that of the Department of Homeland Security.
