Signal Hacked at the Bundestag: Russia Was Reading German MPs' Secret Messages
🤔 How was Signal hacked?
The short answer: Signal wasn't hacked. The app's encryption remains intact. What was compromised was the human being behind the screen.
The attackers — likely Russian according to Germany's BfV domestic intelligence service — used targeted phishing (also called "spear phishing"). They sent messages impersonating trusted contacts of the MPs, tricking them into clicking a malicious link or scanning a rogue QR code.
Signal has a legitimate feature that lets users link multiple devices to one account. The attackers exploited this: by getting victims to scan a fake QR code, they added their own device as a "linked device" — gaining real-time access to all messages without the victim ever knowing.
📅 Timeline of events
- 22 Apr. 2026Revealed by Der SpiegelThe German magazine reveals that Bundestag president Julia Klöckner was targeted in a Signal phishing attack
- 23 Apr. 2026BfV issues warningGerman domestic intelligence warns all MPs: "A large number of Signal groups in the parliamentary sphere are being read by attackers almost undetected"
- 24 Apr. 2026More parties confirmThe SPD and Die Linke admit several of their MPs were also targeted
- 25 Apr. 2026Russian link confirmedIntelligence services attribute the attack to actors linked to Moscow, in the context of Germany's military support for Ukraine
🎯 Why Germany is a prime target
Germany is Europe's largest military aid provider to Ukraine. Since Russia's 2022 invasion, Berlin has faced a surge in cyberattacks, espionage attempts and sabotage operations attributed to Moscow.
Accessing Bundestag Signal groups — where CDU members including Chancellor Friedrich Merz communicate confidentially — represents a goldmine of strategic intelligence for Russia.
- Signal is secure — but a malicious QR code can link your account to a hacker's device
- Never scan a Signal QR code received by message or email without verifying its source
- Regularly check your "linked devices" in Signal — Settings → Linked Devices
- Phishing targets emotions: urgency, trust, authority — always take 30 seconds to think before you click
✅ How to secure your Signal account right now
- Check your linked devices — Signal → Settings → Linked Devices → remove any unknown device
- Enable Registration Lock — Signal → Settings → Account → Registration Lock (requires PIN to link a new device)
- Enable Screen Lock in Signal to prevent access without your passcode
- Be wary of Signal QR codes — only scan them from within the app's official settings
- Signal's encryption is still perfect — the vulnerability is human
- Even security-trained individuals can fall for well-targeted phishing
- Russian cyberattack techniques don't stay limited to governments — they filter down to ordinary users
- A VPN doesn't protect against phishing — only vigilance does
Received a suspicious message on Signal?
Describe it to CyberGuard — it'll analyse it and tell you if it's dangerous in seconds.
🤖 Analyse with CyberGuard →