ICC data breach (2023)

Date 	On 19 September 2023, the International Criminal Court (ICC) first reported the cyber incident as detected “at the end of last week”, i.e., around 15 September 2023.ICC, Statement of the ICC Spokesperson on Recent Cybersecurity Incident, ICC’s Twitter Account (19 September 2023); See also Alicia Hope, Cyber Attack Compromised the International Criminal Court’s Information Systems, CPO Magazine (28 September 2023).
Suspected actor	The ICC stated that the information available as of October 2023 did not allow for a confirmation of the responsible threat actor.ICC, Measures taken following the unprecedented cyber-attack on the ICC, Press Release (20 October 2023).
Target 	The ICC’s computer information system.Carly Page, International Criminal Court says hackers accessed its systems, Tech Crunch (19 September 2023); Toby Sterling and Stephanie van den Berg, War crimes tribunal ICC says it has been hacked, Reuters (19 September 2023).
Method 	The nature of the incident remains unclear,Carly Page, International Criminal Court says hackers accessed its systems, Tech Crunch (19 September 2023). including the method used to infiltrate the network,Carly Page, International Criminal Court says cyberattack was attempted espionage, Tech Crunch (20 October 2023) or whether malware was deployed.Carly Page, International Criminal Court says cyberattack was attempted espionage, Tech Crunch (20 October 2023).
Purpose 	According to the ICC, it was a “targeted and sophisticated” incident the objective of which was espionage and was interpreted as “a serious attempt to undermine the Court’s mandate”.ICC, Measures taken following the unprecedented cyber-attack on the ICC, Press Release (20 October 2023).
Result 	Although it is unclear whether data held in the systems was accessed and exfiltrated,Carly Page, International Criminal Court says hackers accessed its systems, Tech Crunch (19 September 2023). some sources have alleged that the incident has resulted in the leak of highly sensitive documents.See Alicia Hope, Cyber Attack Compromised the International Criminal Court’s Information Systems, CPO Magazine (28 September 2023); Peter Cluskey, Cyber attack on International Criminal Court sparks witness security concerns, Irish Times (20 September 2023). 
The ICC holds very sensitive information about ongoing cases, including criminal evidence and data of protected witnesses.Toby Sterling and Stephanie van den Berg, War crimes tribunal ICC says it has been hacked, Reuters (19 September 2023); Peter Cluskey, Cyber attack on International Criminal Court sparks witness security concerns, Irish Times (20 September 2023).
 
The president of the ICC’s bar association said that lawyers representing both defendants and victims had been affected “in the same manner as the court’s staff” by undisclosed security measures implemented in response to the incident.See Toby Sterling and Stephanie van den Berg, War crimes tribunal ICC says it has been hacked, Reuters (19 September 2023); CyberTalk, International Criminal Court attacked by cyber criminals (20 September 2023).
Aftermath 	The ICC informed that immediate measures were adopted to respond and mitigate the impact of the incident, with the assistance of the Netherlands (host country of the ICC)ICC, Statement of the ICC Spokesperson on Recent Cybersecurity Incident, ICC’s Twitter Account (19 September 2023) and external cyber security experts.ICC, Measures taken following the unprecedented cyber-attack on the ICC, Press Release (20 October 2023). The ICC further announced measures to strengthen its cybersecurity framework, including the use of cloud technology,ICC, Statement of the ICC Spokesperson on Recent Cybersecurity Incident, ICC’s Twitter Account (19 September 2023). and measures to address any compromised data “belonging to individuals, organisations and States”,ICC, Measures taken following the unprecedented cyber-attack on the ICC, Press Release (20 October 2023). including “any potential security risk to victims and witnesses, Court officials and the Court’s operations”.ICC, Measures taken following the unprecedented cyber-attack on the ICC, Press Release (20 October 2023).
As of October 2023, further investigations were being carried out by the ICC with the support of the Dutch National Cyber Security Centre,Toby Sterling and Stephanie van den Berg, War crimes tribunal ICC says it has been hacked, Reuters (19 September 2023); Peter Cluskey, Cyber attack on International Criminal Court sparks witness security concerns, Irish Times (20 September 2023). and the Dutch law enforcement authorities were conducting a criminal investigation.ICC, Measures taken following the unprecedented cyber-attack on the ICC, Press Release (20 October 2023).
The ICC stressed that the incident had come at a moment of heightened security concerns, with daily and persistent attempts against its systems.ICC, Measures taken following the unprecedented cyber-attack on the ICC, Press Release (20 October 2023). In August 2023, the ICC’s Prosecutor warned that the Court could be vulnerable to cyber incidents and that “the alteration of data, and the leaking of confidential information may obstruct the administration of justice at the ICC and, as such, constitute crimes within the ICC’s jurisdiction that might be investigated or prosecuted”.Karim A.A. Khan, Technology Will Not Exceed Our Humanity, Digital Front Lines (August 2023).
Analysed in 	Scenario 02: Cyber espionage against government departments
Scenario 04: A State’s failure to assist an international organization
Scenario 12: Cyber operations against computer data
Collected by: Dominique Steinbrecher
Category:Example
Category:2023