A hack and leak operation steals data and then publishes it, often through a fake hacktivist persona, so that the leak itself does the damage: to reputation, to elections, to diplomacy or to the people named in it. Governments in the UK and US have publicly attributed such operations to Russian military and security intelligence and to Iranian state organisations, and the same pattern now appears against companies, think tanks and individuals. Unlike ransomware, there is often no ransom demand, so the usual extortion playbook does not fit. This guide explains how these operations work, who has been attributed, how to detect the access phase, and how to prepare the technical, legal and communications response. It is for security, legal and communications leads in government, political, media, policy, defence and high-profile commercial organisations. For ideologically motivated activity without state direction, see the Hacktivism Guide.
Key takeaways
- The leak is the payload. Stolen emails and documents are timed and framed for maximum political or reputational effect, so impact depends on audience reaction more than on the volume of data.
- Personas provide deniability. Official attributions describe state units posing as independent hackers: DCLeaks and Guccifer 2.0 for the GRU in 2016, and Homeland Justice and Handala for Iranian actors.
- Personal accounts are the soft target. The 2024 IRGC operation began in personal email accounts of campaign staff, outside corporate controls, using spoofed login pages and stolen MFA codes.
- Response is cross-functional. Forensics, legal notification duties, law enforcement contact and public statements must be co-ordinated, often within hours of a leak appearing.
- Verify before you react. Claims are often exaggerated and leaked sets may be selective, so confirm what was actually taken before confirming anything publicly.
How the attack works
Hack and leak operations combine an ordinary intrusion with an influence campaign. Official records describe four phases.
| Phase | What happens | Typical ATT&CK techniques |
|---|---|---|
| 1. Target and prepare | Research staff and their personal accounts; build fake email and social accounts impersonating trusted contacts or institutions; register lookalike domains | T1589 Gather Victim Identity Information; T1585.001 Social Media Accounts; T1585.002 Email Accounts; T1583.001 Domains |
| 2. Gain access | Credential phishing with spoofed login pages, capture of MFA codes, password spraying or use of compromised VPN accounts | T1566.002 Spearphishing Link; T1598.003 Spearphishing Link (reconnaissance); T1078 Valid Accounts; T1110 Brute Force |
| 3. Collect | Read and export mailboxes, cloud drives and file shares over weeks or months, sometimes with mailbox forwarding rules | T1114.002 Remote Email Collection; T1114.003 Email Forwarding Rule; T1213 Data from Information Repositories |
| 4. Release and amplify | Publish through a persona website, Telegram channel or social accounts, send material to journalists or political opponents, sometimes combined with destructive attacks or defacement | T1491.002 External Defacement; T1485 Data Destruction (when combined with wipers) |
- Dwell time can be long: in the 2022 Albania case, the FBI and CISA found initial access about 14 months before the destructive attack, with periodic email exfiltration throughout.
- Release is staged: the 2024 IRGC indictment describes leaks to media and to the opposing campaign in late June, then further material sent to news outlets from late July through August.
- Personas evolve: the 2018 GRU indictment says the Guccifer 2.0 persona was created after public accusations of Russian involvement and falsely claimed a lone Romanian hacker was responsible.
Credential phishing in these operations increasingly relays the real login page to capture session tokens. See the AiTM Phishing Guide.
Where it shows up
| Operation | Attributed to (as officially stated) | Victims and release channel |
|---|---|---|
| 2016 US election (DOJ indictment, 13 July 2018) | Twelve GRU officers in Unit 26165 (hacking) and Unit 74455 (release). ATT&CK tracks these units as APT28 (G0007) and Sandworm Team (G0034) | Clinton campaign, DCCC and DNC; released through DCLeaks.com and the Guccifer 2.0 persona |
| UK politics 2018 to 2021 (UK government, 7 December 2023) | FSB Centre 18, through Star Blizzard (ATT&CK G1033), which the NCSC assesses is "almost certainly subordinate" to Centre 18 | UK-US trade documents leaked before the 2019 general election; Institute for Statecraft and its founder's account |
| Albania 2022 (FBI and CISA AA22-264A) | "Iranian state cyber actors" under the Homeland Justice persona; ATT&CK campaign C0038 | Albanian government networks; leaks from late July to mid August 2022 alongside ransomware and wipers |
| 2024 US election (ODNI, FBI and CISA, 19 August 2024; DOJ, 27 September 2024) | Iran; three IRGC employees indicted | Personal accounts of campaign officials; material sent to media and the opposing campaign |
| Israel and US 2023 to 2026 (Check Point, ATT&CK) | Void Manticore (G1055), assessed by Check Point as MOIS-affiliated, under the Handala persona | Israeli organisations and US companies; Telegram and leak sites |
Sector exposure is widest for governments, political parties and campaigns, think tanks, universities, journalists, NGOs and defence suppliers, the groups the UK government listed as Star Blizzard targets. Companies become targets when they are linked to a geopolitical issue. See the Handala and Void Manticore Threat Actor Profile Guide and the Iran State Cyber Operations Guide.
Impact
- Reputational and political: the stated aim in the 2024 indictment was to undermine a campaign. The UK government said Star Blizzard attempts to interfere with UK politics were not successful but did lead to leaked documents.
- Personal harm: named staff, sources and families face harassment, and leaked personal data creates breach notification duties.
- Operational: when combined with wipers, as in Albania, recovery adds to the crisis. See the Wiper Malware Guide.
- Legal and regulatory: under UK GDPR, a notifiable personal data breach must be reported to the ICO within 72 hours of becoming aware of it, and individuals told without undue delay where the risk to them is high. The ICO also expects every breach to be recorded.
- Trust in information: once a leak is public, the organisation must manage questions about authenticity, completeness and context, often with incomplete forensic answers.
Detection
The release phase is public, so detection effort belongs in the access and collection phases.
| Signal | Source | Notes |
|---|---|---|
| Sign-ins to mailboxes from new countries, VPN exit nodes or VPS hosting ranges | Identity provider sign-in logs | The IRGC defendants used VPNs and virtual private servers to hide their location |
| New inbox rules forwarding to external addresses | Microsoft 365 unified audit log (New-InboxRule, Set-InboxRule), Google Workspace admin audit | Silent ongoing collection |
| Large mailbox exports, eDiscovery searches or unusual mail volume from Exchange servers | Audit log, network monitoring | FBI and CISA advised watching for unusually large transfers from Exchange |
| Reports of lookalike domains or impersonated senders | Domain monitoring, user reports | The IRGC created accounts impersonating prominent figures and institutions |
| Mentions of your organisation on persona channels or leak sites | Threat intelligence and dark web monitoring | Early warning of release; feed into the response plan |
Metrics
- Coverage: percentage of high-risk staff using phishing-resistant MFA on both work and personal accounts.
- Forwarding hygiene: number of external forwarding rules found per month (target: zero unapproved).
- Time to verify: hours from a leak claim to a confirmed scope assessment.
- Exercise cadence: date of the last leak tabletop exercise with legal and communications.
Prevention and hardening
- Identify the people who matter. List executives, campaign staff, researchers and spokespeople whose mail would be valuable to a state actor, including their personal accounts.
- Move them to phishing-resistant MFA. Use FIDO2 security keys or passkeys for work accounts and help them enrol personal accounts in high-protection programmes such as Google's Advanced Protection. Codes sent by SMS or typed from an app were captured in the 2024 operation.
- Block silent collection. Disable automatic external forwarding by default, alert on new inbox rules, and restrict mailbox export and eDiscovery roles to named, approved administrators.
- Reduce what can be stolen. Apply retention limits to email, keep sensitive negotiation material out of mail, and label documents so you can quickly identify what a leaked file was.
- Harden remote access and exposed servers. The Albania intrusion began with a 2019 SharePoint flaw; patch known exploited vulnerabilities first and require MFA on every VPN.
- Prepare the response. Agree in advance who verifies authenticity, who talks to law enforcement, who decides on statements and how breach notification duties are assessed. Test it in a tabletop. The Ransomware Data Leak Site Listing Playbook covers many of the same steps.
Decision guidance
| Situation | Recommended approach |
|---|---|
| Leak claim, no confirmed intrusion | Hold a neutral statement, start forensic scoping, compare leaked samples with your records before confirming anything |
| Confirmed intrusion, data not yet released | Contain quietly, reset credentials and sessions, contact national authorities (NCSC in the UK, FBI or CISA in the US), prepare for release |
| Leak published with personal data | Assess notification duties immediately (72 hours to the ICO under UK GDPR), support named individuals, record decisions |
| Small organisation without in-house forensics | Pre-agree an incident response retainer and a lawyer; use national reporting routes for state-linked activity |
Where identity fits
Every attributed operation in this guide started with an identity: a password, an MFA code, a VPN account or a mail session. Treat high-risk individuals as privileged users even if they hold no admin rights, monitor their sign-ins, and extend protection to the personal and shared accounts they actually use. Service accounts and OAuth applications with mailbox read permissions deserve the same scrutiny, because a stolen token can export a mailbox as quietly as a stolen password. See the Threat Intelligence for Identity and NHI Guide.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Phishing-resistant authentication | IA-2 | PR.AA-03 |
| Monitoring mailbox and sign-in activity | SI-4, AU-6 | DE.CM-03 |
| Incident response and communications | IR-4, IR-6 | RS.CO-02, RS.CO-03 |
| Security awareness for high-risk staff | AT-2 | PR.AT-01 |
Lessons from incidents
No breach page on this site documents a state hack and leak against a political target, so the lessons come from official records. The 2016 and 2024 US cases show that the release channel is chosen to look independent. The Albania case shows that leaks can come with destruction, which ties the response to the Wiper Attack Response Playbook. The Stryker attack in 2026, claimed by the Handala persona with unverified figures, shows how claims can run ahead of evidence. See the Stryker Cyberattack 2026 page.
Practitioner checklist
- Maintain a register of high-risk individuals and the work and personal accounts they use.
- Enforce phishing-resistant MFA for that register and for every VPN account.
- Disable automatic external mail forwarding and alert on new inbox rules.
- Restrict and log mailbox export, eDiscovery and OAuth applications with mail read scope.
- Monitor persona channels, leak sites and lookalike domains that mention your organisation.
- Write and test a leak response plan covering forensics, legal, law enforcement and communications.
- Pre-draft holding statements and a process for checking authenticity of leaked samples.
- Record every breach decision, including the decision not to notify, as the ICO expects.
Standards and references
- US Department of Justice: Three IRGC Cyber Actors Indicted for Hack-and-Leak Operation
- US Department of Justice: Grand Jury Indicts 12 Russian Intelligence Officers
- UK Government: UK Exposes Attempted Russian Cyber Interference in Politics
- FBI: Joint ODNI, FBI and CISA Statement on Iranian Election Influence Efforts
- CISA and FBI: Iranian State Actors Conduct Cyber Operations Against the Government of Albania
- ICO: Personal Data Breaches, a Guide
- MITRE ATT&CK: Star Blizzard (G1033)
- Check Point Research: Handala Hack, Unveiling the Group's Modus Operandi
Related NHI Mgmt Group resources: Hacktivism Guide · Handala and Void Manticore Threat Actor Profile Guide · Cyber Threat Attribution Guide · AiTM Phishing Guide