Iranian hackers breach FBI director’s personal email and leak photos

Iran-linked hackers have reportedly breached the personal email account of FBI Director Kash Patel, publishing a cache of private photos and messages online.

U.S. officials have acknowledged the incident, with early assessments suggesting the leaked material is authentic.

The intrusion was disclosed earlier today by the threat group calling itself the “Handala Hack Team,” which released samples of the stolen data via its website. Shortly after, a U.S. Justice Department official confirmed to Reuters that Patel’s personal email account had been compromised. Handala is considered by FBI investigators to be a front linked to Iranian state-aligned cyber operations. The threat group also recently claimed an attack against American healthcare tech giant Stryker.

According to the published samples, the compromised account appears to be a personal Gmail inbox containing a mix of private and professional correspondence spanning nearly a decade, from 2010 to 2019. The leaked material includes photographs, some of which show Patel in informal settings, such as smoking cigars, posing with an antique convertible, and taking personal mirror selfies, as well as documents and email exchanges.

The attackers also claimed to have accessed additional sensitive data, including documents and conversations, though these assertions remain unverified. Their public messaging framed the breach as a response to recent U.S. law enforcement actions against their infrastructure.

The Federal Bureau of Investigation, the primary domestic intelligence and law enforcement agency of the United States, plays a central role in counterintelligence, cybersecurity defense, and cybercrime investigations. The compromise of its director’s personal communications, if fully validated, raises concerns about operational security practices and the potential exposure of sensitive contacts or historical discussions, even if the account itself was not an official government system.

It remains unclear whether the breach resulted from credential reuse, phishing, or exploitation of previously leaked login data. We will update this post with new information and/or official statements as soon as these become available.