Second espionage-linked cyberattack hits ICC, exposing persistent threats to global justice systems – Source: www.csoonline.com

The International Criminal Court (ICC) has fallen victim to another sophisticated cyberattack, the second major cyber espionage attempt targeting the war crimes tribunal in just two years. The latest incident occurred last week during the same period that The Hague hosted a high-profile summit of 32 NATO leaders, raising questions about the timing and motivations behind the digital assault.

The ICC confirmed the cybersecurity incident in a statement released June 30, crediting its “alert and response mechanisms” for “swiftly” discovering, confirming, and containing the breach. However, the court declined to provide details about the attack’s impact, the perpetrators’ identity, or whether any sensitive case information was compromised.

When contacted for additional information, ICC spokesperson Fadi El Abdallah said there was “no additional information to share currently” beyond the court’s statement.

The latest incident underscores the mounting cyber threats facing international justice institutions, particularly as the ICC pursues high-profile cases against major world powers and finds itself increasingly isolated on the international stage due to recent US sanctions.

Geopolitical tensions heighten ICC vulnerability

The ICC attack reflects a broader global trend of cybercriminals and nation-state actors increasingly targeting judicial institutions. In the US, court systems have faced a wave of cyberattacks over the past year, including ransomware incidents affecting Jackson County, Missouri, Wisconsin courts, Kansas courts, and Fulton County, as well as denial-of-service attacks on Pennsylvania courts.

The cyberattack on the ICC comes at a particularly challenging time for the institution, which has faced unprecedented pressure from the US. In June, US Secretary of State Marco Rubio announced sanctions against four ICC judges under an executive order signed by President Donald Trump, targeting judges who authorized arrest warrants for Israeli Prime Minister Benjamin Netanyahu and investigations into alleged US war crimes in Afghanistan.

The incident took place during the NATO leaders’ summit in The Hague in June, when world attention was focused on the Dutch capital. The timing suggests either opportunistic targeting during a period of heightened security activity or a calculated attempt to disrupt the court during a moment of international visibility.

The ICC currently has active investigations into several sensitive geopolitical situations, including war crimes cases involving Russia’s invasion of Ukraine (for which it issued an arrest warrant for President Vladimir Putin), the Israel-Hamas conflict in Gaza, and alleged crimes in Afghanistan, Sudan, Myanmar, the Philippines, and Venezuela.

Pattern of sophisticated cyber espionage

This marks the second major cybersecurity incident targeting the ICC in recent years. In September 2023, the court disclosed it had suffered what it later characterized as “a targeted and sophisticated attack with the objective of espionage” that was “a serious attempt to undermine the Court’s mandate.”

According to reports following the 2023 incident, the court experienced prolonged operational disruptions, demonstrating the long-lasting impact that such sophisticated attacks can have on critical international institutions.

The ICC’s cyber troubles reflect broader security challenges facing international institutions. In 2022, Dutch intelligence reported foiling a plot by a Russian spy using a false Brazilian identity to work as an intern at the court, highlighting the multiple vectors through which hostile actors attempt to penetrate international justice institutions. The court has also warned of potential disinformation campaigns designed to undermine its credibility and operations.

ICC takes a proactive approach to cyber-enabled crimes

Even as the ICC faces sophisticated cyberattacks, the institution is developing new capabilities to prosecute cyber-enabled war crimes. In May 2025, the ICC’s Office of the Prosecutor launched a public consultation on its draft policy for addressing cyber-enabled crimes under the Rome Statute, recognizing that “tools used to commit serious international crimes constantly evolve — from bullets and bombs to social media, the internet, and perhaps now even artificial intelligence.”

The ICC is already investigating alleged Russian cyberattacks on Ukrainian civilian infrastructure as possible war crimes, marking the first time cyberattacks are being probed by international prosecutors for potential war crimes charges, according to sources familiar with the case.

Institutional resilience under pressure

As the ICC continues to face mounting cyber threats while pursuing high-profile international cases, the repeated targeting demonstrates the complex cybersecurity challenges facing international institutions that handle uniquely sensitive information, combining legal evidence, witness protection data, and geopolitical intelligence.

The attribution difficulties surrounding both attacks — neither the 2023 nor 2025 incidents have been publicly attributed to specific threat actors — highlight ongoing challenges in cyber attribution even for well-resourced institutions with international support.

Despite the cybersecurity challenges, the ICC emphasized its commitment to continuing operations. In its June 30 statement, the court called for “continued support in the face of such challenges” from States Parties, noting that “such support ensures the Court’s capacity to implement its critical mandate of justice and accountability.”