fancy bear carried out spear phishing attacks on email addresses associated with the democratic national committee in the first quarter of 2016. on march 10, phishing emails that were mainly directed at old email addresses of 2008 democratic campaign staffers began to arrive. one of these accounts may have yielded up to date contact lists. the next day, phishing attacks expanded to the non-public email addresses of high level democratic party officials. hillaryclinton.com addresses were attacked, but required two factor authentication for access. the attack redirected towards gmail accounts on march 19. podesta's gmail account was breached the same day, with 50,000 emails stolen. the phishing attacks intensified in april, although the hackers seemed to become suddenly inactive for the day on april 15, which in russia was a holiday in honor of the military's electronic warfare services. the malware used in the attack sent stolen data to the same servers that were used for the group's 2015 attack on the german parliament.