BERLIN — German federal prosecutors have been conducting a preliminary investigation since mid-February 2026 into alleged cyberattacks on Signal messaging accounts belonging to government officials, a spokesperson for the federal prosecutors confirmed. The investigation involves an initial suspicion of espionage.

The German government suspects Russia is behind a series of phishing attacks on the Signal messaging app targeting two government ministers, other high-ranking politicians, military personnel and journalists, a government spokesperson said. The German government has not officially attributed the attacks to Russia.

Around 300 Signal accounts belonging to individuals within the political sphere were compromised in the phishing attacks. No names of the victims have been officially confirmed. German authorities contacted several politicians personally to warn them that the phishing attacks may have occurred.

Targeted users received messages from a fake Signal security chatbot informing them of suspicious activity on their accounts and asking them to take immediate action. Users who entered a PIN or scanned a QR code had their Signal accounts linked to an external device controlled by hackers. The attackers could then read past chats, follow ongoing conversations and view address books and other data.

In February 2026, Germany's domestic intelligence service BfV and the federal cybersecurity authority BSI issued a public warning that the phishing campaign was likely being carried out by a state-controlled cyber actor. In March 2026, Dutch intelligence and security services warned that Russian state hackers were engaged in a large-scale global cyber campaign to gain access to Signal and WhatsApp accounts belonging to dignitaries, military personnel and civil servants.

Since February 2022, Germany and other European countries have been subject to cyberattacks and other activity linked to Russia. Moscow has repeatedly denied that it is spying on other countries.