Information on Security Incident Pursuant to Article 34 of the GDPR

We would like to inform you of a security incident at the WZB Berlin Social Science Center. All individuals who may have been affected were notified directly; in cases where we were unable to identify certain individuals or where their contact information has changed, we would like to use this opportunity to provide transparent information about the incident and the countermeasures we have taken.

What happened?

While monitoring our IT systems on February 19, 2026, we discovered that there had been unauthorized access to the email accounts of the President and the President’s Office. An external attacker was able to extract email content, file attachments, and communication metadata (so-called exfiltration). The attacker is unknown. This is the subject of ongoing investigations.

 Which date is affected?

The incident affects the confidentiality of the personal data stored in the email accounts in question. If someone has communicated via email with the President or her Office in the past, the following categories of data may be affected:

What consequences could this incident have for the individuals affected?

 There is a risk that the leaked information could be misused. This could take the following forms, for example:

• Unwanted contact or spam: Using the stolen email addresses and communication data, the attacker could send unwanted messages.

• Phishing attacks: The attacker could use the obtained information to compose particularly credible emails (social engineering) in order to obtain passwords or other sensitive data.

• Identity theft: Information from attachments could be used to impersonate someone else in other contexts.

• Reputational risks: Correspondence with the President or the President’s Office may contain confidential information, professional assessments, or personal opinions. Unauthorized publication carries the risk of reputational damage. This applies in particular to the disclosure of content not intended for the public.

Important: At this time, we have no evidence of any misuse of the leaked data.

What steps have we taken?

• Immediately after discovering the incident, we took the following steps:

• Immediate measures: The passwords for the affected email accounts were immediately reset and changed. A comprehensive investigation of the affected systems and data was initiated.

• We have implemented enhanced monitoring of network traffic as well as professional dark web monitoring to immediately identify any potential publication of the data. To date, there are no indications of a data breach.

• We have reported the incident to the relevant data protection supervisory authority as required by law and are in contact with the relevant authority regarding this matter. In addition, a criminal complaint has been filed against unknown persons.

• We are working closely with IT security experts to fully investigate the incident.
   

 What additional measures can you take yourself if you suspect that you may also be affected?

We recommend that you be particularly vigilant in the coming days:

• Be wary of unsolicited emails that may refer to past communications with our institute.

• Carefully check sender addresses and links before clicking on them or opening attachments.

 If you notice any suspicious activity, please contact us at any time.

Our Responsibility and Next Steps

We deeply regret this incident. We take this matter very seriously and are working with the relevant authorities to ensure a swift and thorough investigation.

How to Contact Us

 If you have any questions, please contact us by email at datenschutzvorfall [at] wzb.eu. Additionally, our Data Protection Officer is available to assist you at office [at] datenschutz-nord.de.

28/4/26

28.4.26