Brussels has quietly acknowledged that state-sponsored hackers have been targeting the personal messaging accounts of senior European Union officials. A confidential presentation prepared by the Interinstitutional Cybersecurity Board – the body created in January 2024 to enforce the bloc's digital security rules – reveals a sustained campaign of spearphishing against Signal and WhatsApp users inside the EU institutions.
The document, obtained by Euronews and first reported by Politico, marks the first time the EU has formally admitted that foreign state actors have attempted to compromise the encrypted communications of its own officials. According to the board's experts, the attacks have taken two main forms: direct attempts to take over the Signal and WhatsApp accounts of senior figures, and social engineering tricks that exploit EU-related topics such as sanctions or official statements to lure victims.
A growing threat landscape
The presentation paints a sobering picture of the threats facing the EU's digital infrastructure. Over the past 12 months, more than 190 threat actors were identified as targeting the EU ecosystem, with eight significant incidents recorded in the first half of 2026 alone. The board noted a “strong convergence from all represented institutions on the need to protect sensitive information,” adding that most institutions now rely on internal encryption tools for handling sensitive data.
One concrete example of the campaign came in October 2025, when a Euronews journalist received a suspicious message from an account posing as Signal Support. The message requested a verification code, citing “suspicious activity on your device, which could have led to data leak” – a classic spearphishing technique designed to harvest credentials.
The warnings echo those issued by Germany's security agencies in February, which flagged an ongoing phishing campaign likely linked to state-controlled actors. That campaign specifically targeted Signal users among politicians, military personnel, diplomats, and journalists – a pattern consistent with the attacks described in the EU presentation.
Beyond messaging apps
The board's report also highlights vulnerabilities beyond messaging platforms. In late March 2026, hackers compromised Amazon Web Services accounts that hosted parts of the Europa.eu website, leading to a cloud data breach. The experts also pointed to a broader trend of exploiting weaknesses in widely used productivity software, such as Microsoft applications, and in hardware components.
These incidents underscore the growing sophistication of state-sponsored cyber operations against European institutions. The EU has been stepping up its cybersecurity defences, but the presentation suggests that the threat is evolving faster than the bloc's ability to counter it.
For officials in Brussels, the message is clear: even end-to-end encrypted apps like Signal and WhatsApp are not immune to targeted attacks. The board's recommendations focus on vigilance, multi-factor authentication, and the use of internal secure channels for sensitive communications.
As the EU continues to play a central role in global affairs – from sanctions policy to digital regulation – its officials remain high-value targets. The acknowledgment of these attacks is a rare glimpse into the shadowy world of cyber espionage that increasingly shapes European politics.
