Full Breakdown
Germany Probes Russian-Linked Phishing Campaign Targeting Signal Accounts of Officials
4/27/2026, 10:53:46 PM
Phishing Attack on Signal Accounts
In February 2026 German prosecutors opened a probe after a phishing attack compromised Signal accounts of government officials, diplomats and journalists. Attackers sent fake Signal support messages asking users to enter a PIN or scan a QR code, linking the accounts to a device.
Context and Method
After Russia’s 2022 invasion, German intelligence (BfV) and BSI warned in February of a Russian-linked Signal phishing wave, echoed by Dutch services. The fake alerts asked users to confirm “suspicious activity,” granting attackers read-access to chats, contacts and files.
Who Was Targeted
Der Spiegel estimated roughly 300 compromised Signal accounts. Identified victims include ministers Karin Prien and Verena Hubertz, parliament speaker Julia Kloeckner, a CDU member, and unnamed SPD and Die Linke MPs. Dutch intelligence reported journalists were also targeted.
Impact on Governance
Signal is the preferred encrypted platform for German officials after WhatsApp data-sharing concerns. Compromised accounts jeopardize diplomatic communications, policy deliberations and coordination of military aid to Ukraine, risking exposure of strategic decisions.
Official Statements & Responses
German prosecutors opened an espionage probe without naming a perpetrator. An interior- ministry spokeswoman called it “probably led by a state actor.” Konstantin von Notz called it “extremely worrying” and warned cases would rise. The Russian embassy declined comment; Moscow denies involvement.
Criticism & Opposition
Opposition parties criticised the lack of transparency on the number of affected lawmakers. Deputy speaker Andrea Lindholz ruled out a total Signal ban but said officials are reviewing possible restrictions on the desktop client in parliamentary computers.
Conflicting Reports & Gaps
German authorities have not officially attributed the campaign to Russia, though intelligence services and media repeatedly suggest a Russian state actor. No public list of compromised accounts exists, and the exact victim count beyond the estimated 300 remains unverified.
Verbatim Quotes
- “I will, of course, comply with the summons. I consider it unlikely that the Russian side will be able to substantiate its accusations,” — Alexander Graf Lambsdorff, German ambassador to Russia
- “The number of unreported cases will continue to rise in the coming days,” — Konstantin von Notz, MP, deputy chief of the intelligence oversight committee
- “The federal government is assuming that the phishing campaign targeting the Signal messaging service was presumably run from Russia,” — Government source, cited by AFP
- “Moscow has repeatedly denied it is spying on other countries.” — Russian officials, as reported by multiple news agencies
What’s Next
Prosecutors will continue assessing the breach’s scope and may impose technical restrictions on Signal’s desktop client in parliamentary networks. Security agencies are expected to issue further guidance, and diplomatic channels may address the alleged Russian involvement in upcoming talks.
