In September 2023 the International Criminal Court in The Hague — the permanent court with a mandate to investigate and prosecute genocide, crimes against humanity and war crimes — disclosed that its network had been compromised. It subsequently characterised the incident as a targeted and sophisticated attack whose objective was espionage, and as a serious attempt to undermine the court’s mandate.
The court investigated alongside Dutch authorities, including whether a foreign government was responsible. It said it was reinforcing its risk management framework and its procedures for protecting victims and witnesses. The incident followed the court’s issuing of arrest warrants relating to the situation in Ukraine, after which Russia issued warrants for several ICC officials.
The Records Are The People
A war crimes court holds the identities of witnesses, their locations and their accounts. For some of them exposure is not a fraud risk; it is a threat to their lives and to their families.
We have recorded populations that cannot be notified at 23-0217, where investigative subjects were in the data, and populations that cannot act at 22-0118 and 22-0903. This is the extreme case, and it is why the desk records that no scoring scheme it uses — including its own — can express the difference between this and a marketing list.
Espionage Was The Stated Objective, Not Extortion
The court did not report a ransom demand, encryption or a leak site. What it reported was an attempt to obtain information.
That makes this one of the few files in this corpus where nothing announced itself. We have argued at 26-0802 that this database is built from incidents that produced an artefact — a notification, a listing, an outage. An espionage operation succeeds precisely by producing none of those, which means the ones recorded here are the ones that failed at the last step.
The Desk Attributes Nothing
The context is a matter of public record: warrants issued, warrants issued in return, and an investigation examining state involvement. That context is not evidence.
No state has been established as responsible, the court did not name one, and this desk does not either. The corpus takes the same position at 22-0627 and 22-0715, and it costs something to hold — the inference is available to any reader and the file declines to make it.
Compiled from the court’s own statements and contemporaneous reporting, listed below. The sequence of arrest warrants is a matter of public record and is included as context only. No state is named as responsible and no attribution is asserted. No data categories, volumes or affected individuals were published — which, with the absence of attribution, is why this file is graded medium. Corrections: corrections@forensicpost.com.