The International Criminal Court (ICC) has confirmed that the recent cyber attack was a targeted and highly sophisticated criminal act with the apparent aim of espionage.

At the time of the incident, the ICC took swift action by initiating an immediate incident response, with assistance from The Netherlands, the host state, and external cybersecurity experts. This response included a detailed forensic analysis of the attack, its origins, and its potential impact, as well as implementing initial measures to mitigate the situation.

As part of its commitment to safeguarding data belonging to individuals, organisations, and states, the ICC said it has taken and will continue to take all necessary steps to address any data compromise. Should any specific data entrusted to the court be found to have been compromised, the affected parties will be contacted directly by the ICC. The court’s priority lies in protecting its data and maintaining trust with all stakeholders.

At present, it remains challenging to definitively attribute responsibility for the attack. Dutch law enforcement authorities are actively conducting a criminal investigation to uncover the culprits.

The ICC views this as a serious attempt to undermine its mandate.

In response to this cyber threat, the ICC is bolstering its risk management framework and identifying actions and procedures to be prepared for potential repercussions. This includes addressing any potential security risks to victims and witnesses, Court officials, and the Court’s operations.

Additionally, the ICC has identified a potential threat of disinformation campaigns targeting the institution and its officials, likely intended to tarnish its image and delegitimise its activities.

This recent cyber attack comes at a time when the ICC is facing broader and heightened security concerns. Elected officials, including judges of the court and the prosecutor, have had criminal proceedings initiated against them. The court has also been subject to daily and persistent attempts to attack and disrupt its systems, and it thwarted a nearly successful infiltration attempt by a hostile intelligence officer posing as an intern.