On March 19, 2016, the Russian intelligence-linked group Fancy Bear sent John Podesta, chair of Hillary Clinton’s presidential campaign, a fake Google security alert containing a shortened Bitly link. The link led to a counterfeit login page where Podesta entered his Gmail credentials; a campaign IT employee had mistakenly described the suspicious message as “legitimate” instead of “illegitimate.” Dell SecureWorks found that more than 100 Clinton advisers or campaign staff were targeted by related phishing links, and at least 20 clicked them.
WikiLeaks began publishing more than 20,000 pages of purported Podesta emails on October 7, 2016, releasing installments through October and November. On December 9, 2016, the CIA told lawmakers that the U.S. Intelligence Community had concluded the Russian government was behind the operation and had supplied the material to WikiLeaks; a later CIA, FBI, and NSA assessment said Moscow likely chose WikiLeaks for its reputation for authenticity. Experts judged most messages probably genuine, while cautioning that some could have been altered. The breach exposed campaign strategy, private speeches, and internal media coordination, and became part of the documented foreign cyber-influence campaign surrounding the election.
