Student arrested in German cyberattack that targeted 1,000 politicians, celebrities, journalists

A 20-year-old high school student has admitted stealing private data from nearly 1,000 political leaders, journalists and celebrities and publishing the information online because he was annoyed by their views, German officials said Tuesday.

The cyberattacks had stirred fears of a potential far-right political attack on German institutions by foreign hackers. German Interior Minister Horst Seehofer said during a news conference in Berlin that the student — who still lived at home and identified himself online as “GOd” and “Orbit” — was not aligned with any known group and acted on his own. Seehofer said the student was motivated solely by public statements made by his victims.

“The suspect made a full confession,” said Seehofer, who also rejected criticism that authorities had reacted too slowly to the cyberattack, which unfolded in early December. The suspect, considered a juvenile under German law, was not identified, nor were the victims of the hacks.

“We cannot do anything now to prevent a further distribution of the data released, but we want to do everything we can to prevent anything like this from happening again.”

The 20-year-old was detained Sunday on suspicion of spying and illegally publishing personal information but was later released from custody, according to Georg Ungefuk, a spokesman for the state prosecutor’s office in Frankfurt, which is handling the case.

“He said his motive was that he was angry about public statements made by the politicians, journalists and celebrities that he targeted,” said Ungefuk. “He has expressed his sincere regrets.”

The student, who lives in the western state of Hesse, has been cooperating fully with investigators on the data breach, Germany’s federal crime office said. He destroyed his computer before being detained, authorities said. His house was later searched, but it was unclear whether any belongings were confiscated.

The Reichstag building, which houses the Bundestag lower house of Parliament in Berlin, is shown in a reflection. Hundreds of German politicians were targeted in the cyberattacks.

(Steffi Loos / AFP/Getty Images)

The stolen data was published on Twitter and included home addresses, cellphone numbers, invoices, credit card information, personal chat exchanges, children’s photos and various identification documents.

There had been speculation that right-wing extremists or a foreign power were behind the hacks because private data from members of all political parties except the far-right Alternative for Germany party, known by its initials AfD, had been published. The AfD — whose roster of candidates in the recent elections included some who espoused anti-Semitic views — claimed several seats in the lower house of Parliament.

“The reason the AfD wasn’t hacked is because he didn’t know anything about the AfD,” an investigator told the Bild newspaper. “The young man was described as a nerd without many friends. That’s why he lived out his fantasies of grandeur on his computer.”

The caches of private data were published starting in early December but went largely unnoticed until later in the month.

Because of its notorious past with the Gestapo secret police in the Nazi era and the Stasi security police that reigned in the former Communist East Germany, Germans are extremely sensitive to data protection issues, and the mysterious hacker attack had dominated public attention over the last two weeks. Germany has some of the toughest privacy laws in the world.

Opposition political leaders in Parliament had criticized Seehofer and Chancellor Angela Merkel’s government for its tardy reaction to the attacks. The 20-year-old publicized the private information via links and passwords that he posted on Twitter in daily doses through December. The stolen data came from musicians, journalists, bloggers and political leaders. There were some 18,000 followers of the Twitter account.

Germany has been tightening its cybersecurity since a 2015 hack of the German Parliament’s computer system, which authorities blamed on Russia.

The accused hacker could face up to three years in jail if convicted as an adult. But Ungefuk said the case would likely be prosecuted under the juvenile penal code with greatly reduced penalties.

Kirschbaum is a special correspondent