October 19, 2026, 11:39 am | Read time: 2 minutes
A hijacked email account of the Heilbronn CDU became the starting point for a large-scale phishing attack. Around 6,500 contacts received messages from the cybercriminals, including Chancellor Friedrich Merz.
Attackers Take Over CDU Email Account
Cybercriminals managed to gain access to an email account of the CDU in Heilbronn. They then used the account to send fraudulent messages on a large scale. According to the Heilbronn police, these were sent to around 6,500 contacts.
Among the recipients were numerous individuals from security-relevant sectors. Even Chancellor Friedrich Merz received one of the messages. However, it is still unclear how the perpetrators were able to take over the email account. It is also not yet known what specific information or access data the attackers were targeting in their phishing attack.
Also of interest: Microsoft dismantles AI attack platform
CDU Chats in Bundestag Hacked: Who Is Affected?
Where does the term phishing actually come from?
Invitation Link Aims to Deceive Recipients
One of the sent messages also reached the German Press Agency. The email contained an invitation link for an event where prominent guests were announced. Behind such seemingly interesting links, phishing attempts can be hidden. Their goal is to lure recipients to manipulated sites or to trick them into revealing sensitive information.
Such attacks particularly often target passwords and other access data or bank information. The current case highlights a fundamental problem: If a manipulated message comes from an actually existing and previously hijacked email account, it can appear more credible at first glance than a message from an unknown sender address.
Phishing Attacks Target Politics
Politicians and other groups with access to sensitive information are repeatedly targeted by phishing attacks. Already in the spring, a larger attack via the Signal messenger became known. The attackers targeted politicians, military personnel, diplomats, and investigative journalists, among others.
In the case of the compromised CDU account, the police have now launched an investigation. Among other things, they aim to determine how the cybercriminals gained access to the account. It is also unclear whether recipients fell for the sent link and what damage the attack may have caused.