Data Exposure: German Government Data Leak

The German government is dealing with the fallout of a massive data exposure that includes personal information of hundreds of politicians and other prominent Germans. One of the worst data leaks in German history, every political party with the exception of the far-right Alternative for Germany had data compromised. The information ranges from government correspondence to personal records and financial data. Currently there is no indication of attribution.

Recommendations

This data dump was the result of multiple intrusions targeting individuals associated with several different large entities. Hackers consistently attempt to expose sensitive or personal information to embarrass the victims. Political, military, and extremely wealthy people are predominately the targets of these glory-seeking hacks. We recommend:

• Enabling the Compromised Credential rule in the ZeroFOX platform, which helps monitor for disclosure of emails, passwords, and other sensitive information;
• Avoiding reuse of passwords, which can make you more susceptible to unauthorized account access;
• Enabling two-factor authentication where available; and
• At the enterprise level, implementing rigorous phishing, password, and security hygiene training for employees.

Details

A hacker posted information stolen from German media personalities, music stars, and politicians to the Twitter account @—0rbit (currently suspended) in the “style” of an advent calendar. Each day from December 1st through 24th the account would post a new link to stolen information, with most of the political-related information being posted after December 19th. The leaks contained data stolen from 914 center-right, center-left, and left Germany politicians.

The data itself was hosted on multiple mirror sites, making removal a more complicated and time-consuming process. After an initial analysis of the intrusion, the German government has claimed that most of the data was obtained from private accounts leveraging stolen or otherwise compromised credentials.