# DNC Hack The **DNC hack** was the 2016 intrusion by Russian intelligence into the Democratic National Committee and the Democratic Congressional Campaign Committee. The stolen material was then laundered to the public through front personas and [[WikiLeaks]] on a schedule timed to the campaign. It was the central operational event of [[Russian Election Interference]] in 2016, and it set the template for the [[Hack-and-Leak Operation]]. ## Two intruders Two separate Russian groups were inside the DNC network (see [[Russian State Hacking Groups]]): - **"Cozy Bear"** (APT29) had been there since the summer of 2015. - **"Fancy Bear"** (APT28), the [[GRU]]'s hacking unit, got in around April 2016, using spearphishing to steal campaign and committee credentials and implanting malware to keep access. On **June 14, 2016**, the DNC and its security firm CrowdStrike disclosed the breach and attributed it to Russia. The next day a persona calling itself [[Guccifer 2.0]] claimed to be a lone Romanian hacker and began posting documents. A second front, [[DCLeaks]], had gone live earlier in June. ## The releases On **July 22, 2016**, three days before the Democratic convention, WikiLeaks published about 20,000 DNC emails. Messages showing staff hostility toward the Sanders campaign forced the resignation of DNC chair Debbie Wasserman Schultz. The emails of Clinton campaign chair [[John Podesta]], taken in a separate spearphish, followed on October 7, less than an hour after the [[Access Hollywood Tape]] broke. ## The indictment On **July 13, 2018**, Special Counsel [[Robert Mueller]]'s office indicted **12 GRU officers** in 11 counts: - **Unit 26165** conducted the intrusions. - **Unit 74455** ran the release personas and also targeted state election boards and election-software vendors. The indictment identified DCLeaks and Guccifer 2.0 as GRU operations and stated there was "no allegation" that the conduct altered any vote count. The Senate Intelligence Committee's bipartisan report later reached the same attribution. ## The afterlife The hack generated two durable counter-narratives on the right: - **The [[CrowdStrike Conspiracy Theory]].** The FBI worked from CrowdStrike's forensic images rather than taking the physical servers, and the theory holds that the "real" server was hidden, perhaps in Ukraine. Trump raised "the server" and CrowdStrike in his July 25, 2019 call with [[Volodymyr Zelensky]], the call that led to his first impeachment. - **The [[Seth Rich Murder Conspiracy]].** The theory that a murdered DNC staffer, not Russia, was the source. [[Roger Stone]]'s efforts to reach WikiLeaks about the releases ended in his 2019 conviction for lying to Congress. Trump commuted the sentence in 2020 and later pardoned him. ## See also - [[Guccifer 2.0]] · [[DCLeaks]] · [[GRU]] · [[Russian State Hacking Groups]] · [[Hack-and-Leak Operation]] - [[Russian Election Interference]] · [[CrowdStrike Conspiracy Theory]] · [[Election Interference]] · [[Cybersecurity Lexicon]]