A mailbox in Heilbronn is compromised, and suddenly the question is who else is in that address book.
According to heise, a CDU email account in Heilbronn was hacked in the course of a phishing campaign aimed at Friedrich Merz and numerous other people. This is not a vulnerability in an operating system, not a zero-day, not a spectacular intrusion. It is the oldest attack technique on the internet, and it is still working reliably.
That is the actual finding.
Why a party inbox is worth more than it looks
An email account is less a letterbox today than a master key. Through its recovery function, everything else tends to hang off it: cloud drives, calendars, chats, party software, mailing lists, access to social media accounts. Whoever controls a mailbox can request password resets for services they never attacked. And they can reply — in the name of someone other people trust.
For an attacker with a political interest, that is the cheapest way in there is. You do not have to get past a firewall. You have to get a human to click a link and type a password into a page that looks almost right.
Phishing did not get harder, it got more convenient
The old defence was called two-factor authentication, and it did good service for years. Against modern phishing kits it helps less than hoped. In a so-called adversary-in-the-middle attack, the attacker sits between the user and the real login page: the password is correct, the one-time code is correct, and the session is still taken over, because the attacker steals the session token that is already authenticated. After that, no service asks for a second factor again.
The countermeasures are known and inconvenient: passkeys instead of passwords, because they are bound to the domain and simply do not work on a rebuilt page. Hardware tokens with the same property. And a culture in which a forwarded email is not automatically treated as the boss speaking.
The last point is the hardest, because it cannot be bought.
The political dimension
Attacks on parties are not a sideshow. In Germany, investigators have in the past attributed comparable hacks against parties to foreign intelligence services, repeatedly to the orbit of Russian military intelligence. Whether that applies in the Heilbronn case is not publicly established — and should not be assumed. What can be said: the mailboxes of senior politicians are interesting to state and criminal actors alike, and both groups use the same tools.
For a party the damage is double. Once through what was in the mailbox — internal assessments, appointments, contacts, possibly personal data. Then through what was sent from it: every message from a compromised address inherits the sender's trust. That is exactly why hijacked mailboxes are such effective amplifiers for further phishing waves.
What parties and authorities get wrong
Two patterns repeat. First, the timeline: weeks often pass between compromise, discovery and public disclosure. During that time the attack continues while those affected believe everything is fine. Second, jurisdiction: parties are not critical infrastructure in the legal sense, and their IT is often grown, decentralised and run by volunteers. A district association in Heilbronn does not have the security department of a blue-chip company — and still has access to correspondence an intelligence service would find interesting.
The obvious consequence is unpopular because it costs money: centrally run, professionally operated mailboxes for officeholders, mandatory passkeys, login logging and a reporting channel that does not run through the press office.
What this case is not
It is not proof that email is insecure, and not an argument for a return to closed systems. It is proof that the weakest point is still the human at the screen — and that defending against that does not consist of speeches about cyber defence, but of boring, universal basic hygiene.
What to watch
Whether the case is cleared up and whether there is a robust statement on authorship. Whether more mailboxes in the same circle are affected — with this attack type, one compromised account is rarely the only one. And whether the parties sort out their IT responsibilities after the next election, or only after the next incident.
