Iran-linked Hackers Breach FBI Director's Personal Email

The U.S. Department of Justice confirmed that the email account of FBI Director Kash Patel had been compromised, following claims by a hacking group with alleged ties to Iran. The incident marks a significant cybersecurity concern involving a top U.S. intelligence official.

Officials at the Department of Justice acknowledged the breach but declined to provide further details about the scope or potential impact. The confirmation comes after the hackers publicly claimed responsibility and began releasing materials online.

The FBI said it was aware of "malicious actors" targeting Patel's email information, adding that "the information in question is historical in nature and involves no government information," according to the BBC. The agency is offering up to $10 million for information that helps identify members of the Handala group.

Clash Report

Photos the group says it took from Patel's account show him at various unidentified locations, including next to a vintage convertible and a jet, and smoking cigars. The group said its hack was retaliation for the FBI's seizure of its websites and for the $10 million reward. "Soon you will realize that the FBI's security was nothing more than a joke," it wrote.

A group calling itself “Handala Hack Team” said it had accessed Patel’s personal email inbox and published photos along with what it described as his resume. In a statement posted online, the group declared that Patel had joined its list of “successfully hacked victims.”

Why Handala Targeted Patel

The hack followed a Justice Department operation earlier this month. Last week the department seized four Handala domain names it said were used in hacking schemes linked to the Islamic Republic of Iran. It said Iran's Ministry of Intelligence and Security had used the sites to spread "terrorist propaganda," conduct psychological operations and call for the killing of journalists and dissidents.

Patel had vowed to "hunt" the group. "This FBI will hunt down every actor behind these cowardly death threats and cyberattacks and will bring the full force of American law enforcement down on them," he said. Western researchers believe Handala is one of several personas used by Iranian government cyber-intelligence units, Reuters reported. The group's attacks on U.S. targets followed the U.S.-Israeli attack that killed Iran's Supreme Leader Ayatollah Ali Khamenei.

Questions Over the Leaked Material

Reuters said the Gmail address matched an account linked to Patel in previous data breaches preserved by the dark web intelligence firm District 4 Labs, and the Justice Department suggested the emails appeared to be authentic. The BBC said it had not independently verified the documents.

Cynthia Kaiser, a former FBI cyber official now at Halcyon, told the BBC the messages "look very old" and may come from an earlier compromise that was recycled. Iranian-backed hackers were reported to have breached Patel's private communications in 2024, weeks before he was appointed to lead the FBI, though it is not clear whether that was a different breach.

Experts say such operations do not necessarily require much sophistication. "Personal accounts don't have the same level of protection and alerting as government systems, so these are often an attractive target for hackers," said Dave Schroeder of the University of Wisconsin-Madison.

Part of a Wider Cyber Conflict

Earlier in March, Handala claimed a cyberattack on U.S. medical technology firm Stryker that it said wiped more than 200,000 systems. Clash Report has since reported on Iranian hackers shutting down a British power plant for four days, on Trump authorizing U.S. companies to launch cyberattacks against hackers, and on how Patel built security ties with China and Russia.