On Friday, October 17, 2026, unknown attackers gained access to an email account belonging to the CDU district association in Heilbronn, Germany. From that genuine account they pushed out a phishing campaign to roughly 6,500 contacts, and the recipient list reached the very top of the German state: federal ministries, other political contacts and Chancellor Friedrich Merz himself all received the fraudulent message.
The Heilbronn police are investigating. A police spokesperson told the German Press Agency that, according to initial findings, the email went to around 6,500 contacts, many of whom work in security-relevant areas, and that messages demonstrably reached the Chancellor.
A real account, a fake invitation
The phishing email was built as an invitation to an event with prominent guests and contained a link. According to the police, the working assumption is a phishing attempt, the classic scheme in which criminals try to trick recipients into handing over sensitive data such as passwords or bank details. The German Press Agency itself was among the recipients, as was the Heilbronn police.
The local district association responded by having an IT security firm inform affected contacts about the incident and warn them not to react to the messages or open any links or attachments they contain. Investigators have not yet said how the attackers obtained access to the account, and no details about the payload behind the invitation link have been disclosed.
Why this attack sails past DMARC
For anyone working on email authentication, this case is an uncomfortable but important reminder. SPF, DKIM and DMARC answer a narrow question: does this message really come from the domain it claims to come from, and is the domain owner willing to vouch for it?
A message sent from a genuinely compromised mailbox comes from the real domain, on real infrastructure, often signed with real DKIM keys. Every authentication check passes, because from the protocol’s point of view nothing is forged. The attack does not spoof the CDU. It is the CDU account, hijacked.
This is precisely why the security industry keeps repeating that DMARC is a foundation and not a fortress. Enforcement at the “reject” policy stops outsiders from counterfeiting your domain, and that matters enormously, because lookalike domain spoofing remains one of the cheapest attacks in email. But it does nothing about an attacker who logs into a legitimate mailbox and sends from it.
What actually helps when the account is the weapon
The defenses that touch this scenario are different. Multi-factor authentication, and especially phishing-resistant methods such as passkeys or hardware keys, raises the cost of the initial takeover. Conditional access policies that flag logins from unusual locations or devices can catch the compromise early. Mail providers that detect a sudden burst of outbound volume, thousands of messages in minutes to a contact list spanning ministries, can throttle the blast before it completes.
DMARC still earns its place in this picture. First, without enforcement the same attackers could have skipped the trouble of hijacking anything and simply spoofed the CDU domain from outside, an even cheaper path. Second, aggregate DMARC reports are a visibility tool: a sudden shift in sending patterns, new sources or unusual volume from your own domain is exactly the kind of anomaly that reporting surfaces early.
The political target set keeps repeating
German authorities have warned for years that political organizations are prime phishing targets. In spring, a large-scale phishing attack ran through the Signal messenger and targeted politicians, military officials, diplomats and investigative journalists, with Germany’s BSI and domestic intelligence attributing it likely to state-controlled actors. Whether Friday’s Heilbronn incident has any connection to such actors is not known; the police have made no attribution, and none should be assumed.
What is known is the structural weakness the case exposes. A district association, a mid-sized political office with a contact book full of government addresses, held the keys to inboxes across the federal government. One compromised account was enough to put a crafted link in front of 6,500 of them in a single afternoon.
Authentication proves the domain, not the human behind it. Hijacked-account phishing like the Heilbronn case passes every DMARC check, but the reporting layer still gives you early sight of abnormal sending from your own domain, while enforcement keeps outside spoofers from forging you the cheap way. Sign up for free to Excello Mail and get that visibility before your next alert comes from the police.