On March 19, 2016, Russian intelligence-linked hackers identified by cybersecurity researchers as Fancy Bear sent John Podesta a convincing Google security-alert email containing a shortened Bitly link. Podesta entered his Gmail credentials on a counterfeit login page after a campaign IT employee mistakenly described the suspicious message as “legitimate” rather than “illegitimate.” SecureWorks traced related phishing infrastructure and found that more than 100 Clinton policy advisers or campaign staff had been targeted; by June, 20 staff members had clicked malicious links. The breach also exposed Podesta’s iCloud password and briefly compromised his Twitter account.
WikiLeaks began publishing the material on October 7, 2016, releasing more than 20,000 pages in installments during the final weeks of the U.S. presidential election. On December 9, the CIA told lawmakers that the U.S. Intelligence Community had concluded the Russian government was behind the hack and had supplied the emails to WikiLeaks; a declassified CIA, FBI, and NSA assessment said Moscow most likely chose WikiLeaks for its reputation for authenticity. Most messages were considered probably genuine, with no evident forgeries identified by intelligence agencies, although experts warned that some documents could have been altered. The episode became a major example of state-linked cyber-espionage and election influence operations, while WikiLeaks’ uncurated publication amplified political damage without resolving every question of provenance.
