Iran-linked hackers successfully breached FBI Director Kash Patel's personal email account, accessing and publicly releasing personal photographs and documents. The pro-Palestinian hacking group, Handala Hack Team, announced the operation on its website, declaring that Patel "will now find his name among the list of successfully hacked victims". A Justice Department official confirmed the authenticity of the breach and the materials published online, which reportedly date from roughly 2010 to 2019. The compromised information included a range of personal correspondence and travel-related communications, as well as photographs showing Patel in casual settings, smoking cigars, riding in an antique convertible, and posing with a bottle of rum.
The Handala Hack Team, identified by Western researchers as a persona used by Iranian government cyberintelligence units, framed the attack as a direct response to US military action against Iran and its allies. The hackers stated the operation was retaliation for the FBI's recent seizure of their domain names and for the US offering a $10 million reward for information leading to their identification. The group's statement mocked US cybersecurity claims, noting that the "so-called 'impenetrable' systems of the FBI were brought to their knees within hours". Handala warned that this "is just our beginning," signaling further operations. The hack comes amid ongoing US-Israeli military strikes on Iran that began on February 28, 2026.
The Patel email breach follows a significant cyberattack earlier in March against Michigan-based medical technology giant Stryker, for which Handala also claimed responsibility. On March 11, the group said it had extracted 50 terabytes of data and wiped over 200,000 systems, servers, and mobile devices, causing global network disruptions for the company. Handala justified that attack as retaliation for "the brutal attack on the Minab school" in Iran, where authorities said 150 people were killed, and for "ongoing cyber assaults against the infrastructure of the Axis of Resistance". The group has also claimed to have "full access" to Jerusalem's security cameras in recent weeks.
This is not the first time Patel has been targeted. Iranian-backed hackers reportedly breached Patel's private communications in 2024, weeks before he was appointed to lead the FBI. The FBI acknowledged it was aware of "malicious actors" targeting Patel's email information, though it emphasized that the accessed information was "historical in nature and involves no government information". Cybersecurity researcher Ron Fabela noted that the compromise involved personal materials such as family photos and information related to Patel's past apartment search, stating, "This isn't an FBI compromise, it's someone's personal junk drawer".
The FBI is currently offering up to $10 million for information that helps identify members of the Handala group. Last week, the US Justice Department seized several Handala domain names it said were involved in hacking schemes linked to Iran's Ministry of Intelligence and Security (MOIS). The department accused the group of spreading "terrorist propaganda," conducting "attempted psychological operations targeting adversaries of the regime," and calling for the killing of journalists and dissidents. Handala's hack into Patel's email account was registered the same day the Justice Department announced these domain seizures, on March 19. US intelligence officials have repeatedly warned that Tehran might use its cyber capabilities to retaliate against American and Israeli targets amid the ongoing conflict.