Germany’s government is dealing with an ongoing security crisis after hackers managed to access its intranet and collect confidential information, a senior lawmaker said on Thursday.

Following an emergency meeting between government officials and the Bundestag’s parliamentary control committee, CDU politician Armin Schuster confirmed reports of a “a real cyber-attack on part of the government system”, which was being treated as “an ongoing process, an ongoing attack”.

The comments appear to contradict earlier government assurances that the security breach had been “isolated and brought under control”. On Thursday morning the deputy interior minister, Ole Schröder, told the RND newspaper group that security officials had allowed hackers “controlled” access to government networks in order to track possible culprits and their methods.

German media have blamed a Russian hacking group variously known as “Snake” or “Turla” for the attack. Earlier reports had cited security experts who linked the incident to notorious Russian hacking group “Fancy Bear” or “APT28”, which some believe has connections to Russia’s GRU military intelligence agency and has been accused of attacks on Hillary Clinton’s 2016 US presidential campaign.

There has been no official confirmation of the identity of the perpetrators, and some MPs have suggested that another group of hackers could be deliberately copying Fancy Bear’s methods.

According to reports in German media, the hackers focused their attack on the foreign ministry, which in the view of some lawmakers would suggest a foreign intelligence agency as the orchestrator of the hacking operation.

The German government’s data network, known as IVBB, operates separately from the public internet, and is used mainly to allow the secure exchange of information via phone and email between ministries in Berlin and the old West German capital in Bonn, which is still home to some ministries and government offices.

If hackers managed to extract material from the network via spyware, they could have obtained information on the future development of the German military, as well as confidential diplomatic reports.



In 2015, Germany’s Federal Office for Information Security (BSI) had to pull the plug on the intranet services of the parliament, known as “Parlakom”, after it emerged that hackers had riddled the system with spyware.

Seventeen gigabytes of data were siphoned off the internal system during the attack, for which Russian group Fancy Bear was widely blamed. Fears that information obtained by the hackers could be leaked to influence the outcome of the German elections last September never materialised, however.

At the time, government officials had assured politicians that the government’s IVBB network represented a superior quality of cybersecurity that was harder to penetrate than Parlakom.

In light of the rising frequency of attacks, Germany’s defence ministry in 2016 set up a cyber department to coordinate a response to online intrusions.