New evidence suggests DNC hackers penetrated deeper than previously thought

The suspected hacking of a Democratic National Committee consultant's personal Yahoo Mail account provides new evidence that state-sponsored attackers penetrated deeper than previously thought into the private communications of the political machine attempting to defeat Republican nominee Donald Trump.

According to an article published Monday by Yahoo News, the suspicion was raised shortly after DNC consultant Alexandra Chalupa started preparing opposition research on Trump Campaign Chairman Paul Manafort. Upon logging in to her Yahoo Mail account, she received a pop-up notification warning that members of Yahoo's security team "strongly suspect that your account has been the target of state-sponsored actors." After Chalupa started digging into Manafort's political and business dealings in Ukraine and Russia, the warnings had become a "daily occurrence," Yahoo News reported, citing a May 3 e-mail sent to a DNC communications director.

It was one of more than 19,000 private DNC messages posted to WikiLeaks on Friday. The massive e-mail dump came five weeks after DNC officials said hackers with backing from the Russian government had breached its network and made off with opposition research into Trump and almost a year's worth of private e-mail. The airing on WikiLeaks, which included messages in which DNC officials derided Democratic candidate Bernie Sanders, has already led to the resignation of Chair Debra Wasserman Schultz. Now, the revelations about Chalupa's Yahoo account suggest the hack may have gone deeper than previously reported.

According to Yahoo News:

But Chalupa’s message, which had not been previously reported, stands out: It is the first indication that the reach of the hackers who penetrated the DNC has extended beyond the official email accounts of committee officials to include their private email and potentially the content on their smartphones. After Chalupa sent the email to Miranda (which mentions that she had invited this reporter to a meeting with Ukrainian journalists in Washington), it triggered high-level concerns within the DNC, given the sensitive nature of her work. “That’s when we knew it was the Russians,” said a Democratic Party source who has knowledge of the internal probe into the hacked emails. In order to stem the damage, the source said, “we told her to stop her research.”

A Yahoo spokesman said the pop-up warning to Chalupa “appears to be one of our notifications” and said it was consistent with a new policy announced by Yahoo on its Tumblr page last December to notify customers when it has strong evidence of “state sponsored” cyberattacks. “Rest assured we only send these notifications of suspected attacks by state-sponsored actors when we have a high degree of confidence,” wrote Bob Lord, the company’s Chief Information Security Officer, in the Tumblr post.

The DNC's contention that Russia was behind the attack was based on an assessment from security firm CrowdStrike, which was brought in to investigate the committee's network. Monday's article went on to raise the possibility that the hackers obtained much more sensitive material than DNC officials indicated in the days immediately following their disclosure of the breach:

The extent of the damage was at first unclear. When they first authorized a public release of the CrowdStrike analysis, party officials said that the hackers had targeted oppo files on Donald Trump. But they told reporters that no personal information about donors had been penetrated. Party officials are no longer standing by those assurances. Two sources familiar with the breach said that the hackers’ reach was far more widespread than initially thought and includes personal data about big party contributors and internal “vetting” evaluations that include embarrassing comments about their business dealings (as well as gossipy internal emails about the private affairs of DNC staffers). One newly posted email discusses a prospective DNC donor’s offering to host a fundraiser with President Obama, noting that he had previously been convicted in a case involving allegations that he killed 50 horses, as part of an insurance fraud scheme. Party officials are bracing for more damaging document dumps after Labor Day. “They’re having to do serious damage control with the donors right now,” said a party official familiar with the matter.

There are also signs that the hackers have penetrated the personal email of some Clinton campaign staffers—at least those who were in communication with senior DNC staff members. On May 6, John McCarthy, a DNC consultant who has since joined the Clinton campaign to do outreach to religious groups, sent an email to Chalupa from his personal Gmail account that was then forwarded to other party officials. McCarthy proposed arranging for religious leaders who have “condemned Trump for bringing out the worst in America” to stage a protest at the Republican National Convention. “It would be great to try and engage them and get them to do something at convention, etc. Maybe do a vigil at the Cleveland convention?” McCarthy wrote in the email, which included his personal cellphone number and which has now been posted as part of the WikiLeaks data dump.

There is still much that is not known about the DNC hack and how, if the Russians are indeed behind it, the emails found their way to WikiLeaks. Some commentators have noted that WikiLeaks founder Julian Assange has in the past hosted a talk show on RT, the Russian television network that serves as a propaganda arm for the Kremlin. (Assange, without providing specifics, recently claimed he will be posting more emails that will be damaging to Clinton and “provide enough evidence” to get her arrested.)

While the Russian government's involvement in the breach and subsequent dump remains unconfirmed, the incident is unsettling because it demonstrates the influence hackers—whatever their affiliation or motivation may be—can have over the US electoral process. The use of Yahoo Mail and the lack of encryption when distributing internal vetting evaluations and other highly sensitive documents are also troubling because they suggest Democratic officials failed to adequately protect against hacking attacks they should have known were inevitable.