Hackers linked to the Iranian government have broken into FBI Director Kash Patel’s personal email account and published stolen materials online, including photographs and documents, a source familiar with the breach has confirmed. The incident marks the latest in a series of Iranian-linked cyberattacks targeting senior American officials amid the ongoing US-Israeli military campaign against Iran.
The hacking group published a series of photos of Patel taken before he became FBI director, claiming they were stolen from his personal account. A source familiar with the incident confirmed the images were authentic. A preliminary review of the files conducted by CNN with the assistance of an independent cybersecurity researcher found that the stolen emails appear to date from around 2011 to 2022 and include personal, business, and travel correspondence with various contacts.
However, cybersecurity researcher Ron Fabela was quick to put the breach in perspective. What the hacking group is billing as a penetration of “impenetrable” FBI systems is, in reality, far more mundane. “This isn’t an FBI compromise — it’s someone’s personal junk drawer,” he said, noting the stolen material included things like family photos and details from Patel’s previous search for an apartment.
The FBI confirmed the breach and stated that no government information was obtained. The bureau is offering a $10 million reward for information leading to the identification of the group behind the attack, known as the Handala Hack Team, which the FBI says has
frequently targeted US government officials. “The FBI is aware of malicious actors targeting Director Patel’s personal email information, and we have taken all necessary steps to mitigate potential risks associated with this activity,” the bureau said in a statement.
This is not the first time Iranian-linked hackers have accessed Patel’s private information. In late 2024, just weeks before he was appointed to lead the FBI, Patel was informed by officials that he had been targeted as part of an Iranian hacking operation and that some of his personal communications had been accessed. That earlier breach was part of a broader foreign hacking effort — involving operatives from both China and Iran — that targeted incoming Trump administration officials, including now Deputy Attorney General Todd Blanche and Donald Trump Jr.
The Iran-linked group claiming responsibility for the latest breach also carried out a cyberattack earlier this month that disrupted operations at a major US medical device manufacturer. The group said at the time that it was retaliating for a missile strike on an elementary school in Iran, which Iranian state media claims killed at least 168 children. The
Pentagon has said it is investigating that incident.
The US Justice Department has accused the hackers of working on behalf of Iran’s Ministry of Intelligence and Security and responded to the attack on the medical device company by seizing websites used by the group to disrupt their operations. Despite those efforts, the Iranian cyber operatives have continued to carry out attacks and spread propaganda. US intelligence officials have repeatedly warned that Tehran-linked hackers are likely to escalate their cyberattacks in retaliation for the US and Israeli bombing campaign against Iran that began last month.
