Overview
- Federal prosecutors in Karlsruhe are investigating after coordinated phishing took over more than 300 Signal accounts used by politicians, officials and some NATO staff.
- Attackers posed as Signal support and tricked targets into sharing their security PINs, which let them register the accounts on new devices and read chats, photos and documents.
- Dutch intelligence and the FBI have pointed to Russian state‑linked actors as likely behind the campaign, and media in Germany reported the same, though Berlin has not issued a formal attribution.
- Parliament leaders are steering communication toward Wire Bund, a closed, BSI‑reviewed messenger hosted on government servers that can use email IDs instead of phone numbers and is cleared for VS‑NfD material.
- Signal says it will add protections to reduce phishing, yet MPs and parties can use their own IT and private phones, which limits enforcement and keeps the risk of future compromises high.