How Hackers Really Get In (2011-2016): Breaches Born in One Email

Forget the movie version of hacking. Some of the most serious breaches of the past fifteen years began with one person opening one message. Three real case files: RSA in 2011, the German parliament in 2015, and the Clinton campaign in 2016.

Films show hacking as a race against the clock: a figure in a dark room, lines of green code, a progress bar crawling towards "access granted". Real intrusions are usually duller than that. Someone receives an email, thinks it looks fine, and clicks.

That's not an exaggeration. Some of the most serious breaches of the last fifteen years, against a security company, a national parliament and a presidential campaign, began exactly that way. These are three case files, told from the point of view of the inbox, along with what each one teaches the rest of us.

Case file 1: RSA, 2011. The spreadsheet in the junk folder

RSA is a security company. Among other things, it made SecurID tokens, small devices that generate a changing code so that logging in needs more than a password. Defence contractors and government agencies relied on them. Which is exactly why someone wanted to break in.

In March 2011, two phishing emails were sent over two days to small groups of fairly junior employees at EMC, RSA's parent company. The subject line was "2011 Recruitment Plan". The message body was a single short line asking the recipient to review the attached file. Nothing about it was clever.

One employee dug the message out of their junk mail folder and opened the attachment, a spreadsheet called "2011 Recruitment plan.xls". Inside was a small Adobe Flash object that exploited a flaw nobody had fixed, because nobody yet knew about it. That kind of unknown flaw is called a zero-day. It quietly installed a remote-access program called Poison Ivy, and the attackers started exploring the network.

They eventually took information related to SecurID. Weeks later, defence contractor Lockheed Martin fended off an attack that used information from the RSA breach. RSA offered to replace tokens for customers, and by one report about ten percent of its customers took them up on it.

The lesson: the email wasn't sophisticated, and F-Secure's analysts said so at the time. But because the flaw was a zero-day, even a fully updated computer would have been caught. The defence had to be somewhere else: not storing too much in one place, spotting strange activity early, and not treating the junk folder as a harmless place to go fishing for messages.

Case file 2: The German parliament, 2015. A newsletter from the United Nations

In late April 2015, members of the German Bundestag received emails that appeared to come from an address ending in un.org, the domain of the United Nations. They were styled like news bulletins. Some carried subject lines about the conflict in Ukraine, according to press reports of the time. A link inside appeared to lead to a UN document. In reality, it installed malware.

Once in, the attackers worked their way through the parliament's network. By the time the intrusion was spotted in May 2015, they had reportedly gained administrative control and stolen around 16 gigabytes of data, including tens of thousands of emails from lawmakers. The system had to be taken offline for several days while it was cleaned up.

Years later, in 2020, German federal prosecutors issued an arrest warrant for a Russian man they suspected of being part of the group known as APT28, or Fancy Bear, and the German government said there was reliable evidence he worked for Russia's military intelligence service, the GRU. Germany pursued European Union sanctions. Russia has rejected the accusations. As with most attributions, the public record consists of what governments and prosecutors say, so we've phrased it the same way.

The lesson: a trusted name is cheap to borrow. Putting a real organisation's domain in the "from" line can be made to look convincing, and someone who regularly gets mail from international bodies has little reason to doubt one more.

Case file 3: The Clinton campaign and the DNC, 2016. A security alert that wasn't

This one is worth describing carefully and without taking sides, because it's a security story, not a political one. Everything below comes from the US indictment and the reporting around it.

According to US investigators, in March 2016 officers of Russia's GRU sent roughly ninety spearphishing emails to addresses at the Clinton campaign in the space of a few days, then moved on to Google accounts used by campaign staff. One of the targets was campaign chairman John Podesta. He received a message designed to look like a security alert from Google, telling him to change his password and giving him a link to do it. The link was disguised using a URL shortener, so the real destination was hidden. The page it led to was a fake designed to capture whatever was typed into it.

Reporting at the time said that staff had passed the message to a security technician and had been told to follow its instructions, which they did. The result, according to the indictment, was access to an account holding more than 50,000 emails. A month later, a staff member at the Democratic Congressional Campaign Committee was reportedly phished in much the same way, and their stolen credentials were used to reach that network. The Democratic National Committee's network was compromised as well. The indictment, announced in July 2018, named twelve GRU officers. It didn't allege that any vote tallies were altered. Russia denies involvement.

The lesson: nobody needed to break any software. The attackers simply asked for a password, politely, in a believable voice.

What the three emails had in common

Case	The disguise	The ask	The result
RSA, 2011	An ordinary internal-looking file	Open the attachment	Backdoor installed; SecurID data taken
Bundestag, 2015	A bulletin from the United Nations	Click the link	Malware; about 16 GB stolen
Clinton campaign and DNC, 2016	A security alert from Google	Click, then enter your password	Credentials captured; tens of thousands of emails stolen

Look closely and the pattern is striking. Each email borrowed a source people trust, whether an internal colleague, an international body or a technology giant. Each asked for one small, ordinary action. And in each case the target was a person who had good reason to be busy, which is the ideal state to be in when a message like this arrives.

Another thing links the second and third cases. German authorities and US prosecutors both pointed to the same service, Russia's GRU, and security researchers link the activity to the group known as APT28 or Fancy Bear, working in a similar way a year apart on different continents. Same craft, different disguise.

Why "I'd never fall for that" is the wrong lesson

It's tempting to read these stories and feel quietly superior. But look at who was targeted: employees at a security company, national lawmakers, experienced political operatives. These weren't people who had never heard of phishing. They were people for whom a single message was one of hundreds that day.

The better lesson is that defence has to assume someone, somewhere, will eventually click. That shapes what good security looks like:

Make stolen passwords useless. Two-step login stops a captured password from being enough, and physical security keys go further, because they won't work on a fake website.
Patch quickly. It wouldn't have saved RSA from a zero-day, but it closes the doors that attackers use far more often. The WannaCry story shows what a missing update costs.
Limit what any one account can reach. A single compromised mailbox shouldn't be a key to everything.
Make it easy to report. An employee who can flag a strange message in two clicks, without embarrassment, is worth more than any filter.
Watch for odd behaviour inside the network, because the early hours of an intrusion are quiet and easy to miss.

What you can take home from this

You probably aren't guarding a parliament. But the same tricks are used on everyone, just with less research behind them. A few habits cover most of the risk:

Never log in through a link in an email. Open the site or app yourself, and check for the alert there. That single habit defeats the Google-alert trick completely.
Let your password manager be your alarm. It only fills in passwords on the exact site it saved them for. If it stays blank on a page that looks genuine, stop.
Be suspicious of attachments you didn't ask for, even if they look routine. The RSA email was a dull one-liner.
Don't trust the "from" line on its own. It's easy to fake. Judge the request, not the name.
Turn on two-step login, especially for your email account, since it's the key to your other accounts.

We take apart a modern phishing message, line by line, in how a disposable email can help against phishing, and the older, attachment-based version of this trick is covered in the story of the ILOVEYOU worm and our guide to how email lets malware in.

Where a throwaway address fits, and where it doesn't

Being straight about it: a temporary email address would not have saved any of the people in these stories. They were targeted at their real work and personal accounts, and those accounts need real addresses.

Where disposable email helps is further upstream. Targeted attackers research their victims, and an address that has been scattered across dozens of sign-up forms is easier to find, easier to link to a name, and more likely to sit on a leaked list. Keeping your real address for the few places that need it, and using a throwaway for everything else, simply gives an attacker less to work with. It's a way of shrinking the target, not a shield.

Ordinary emails, extraordinary consequences

It's humbling that so much damage came from messages so ordinary: a one-line note, a bulletin, a security alert. Nobody in these stories was foolish. They were busy, the lure was good, and the click took a second. The takeaway isn't to be afraid of your inbox. It's to build habits, and systems, that don't depend on every single person being perfect every single time.

How Hackers Really Get In (2011-2016): Real Breaches That Started With One Email