A hacker who breached TeleMessage, the message-archiving service used by former Trump national security adviser Mike Waltz, intercepted communications from a far wider set of American officials than previously reported. A Reuters review of a leaked data cache provided by Distributed Denial of Secrets identified more than 60 unique US government users of the platform, spanning disaster response, customs enforcement, diplomacy, the Secret Service and at least one White House staff member. The intercepted traffic covers a roughly day-long window ending May 4. TeleMessage has been suspended since May 5.
What Happened
TeleMessage sells modified builds of popular consumer messaging apps, including a variant of Signal, that capture and archive message content so agencies and regulated firms can meet federal and financial recordkeeping requirements. The product was little known outside government and finance until an April 30 Reuters photograph showed Waltz checking the TeleMessage version of Signal during a Cabinet meeting.
Within days, an attacker breached the service and pulled archived message data off it. That data reached Distributed Denial of Secrets, a US non-profit that archives hacked and leaked material, which provided a cache to Reuters. The company took the service offline on May 5, saying it did so "out of an abundance of caution." TeleMessage is owned by Smarsh, a Portland, Oregon digital communications firm, which did not respond to requests for comment.
The critical detail for defenders: the exposure was not limited to one principal's account. The archive was a shared repository, and the compromise reached whatever it held.
What Was Taken
Reuters identified more than 60 distinct government users in the leaked cache. Material in the trove came from:
- Disaster responders, including messages to and from FEMA aid applicants
- Customs officials
- Several US diplomatic staffers
- At least one White House staff member
- Members of the US Secret Service
- Private sector users, including at least one financial services firm
Many of the captured messages were fragmentary, and the coverage window was roughly 24 hours ending May 4. Reuters could not verify the entire cache, but in more than half a dozen cases it confirmed that phone numbers in the leaked data were correctly attributed to their owners. A FEMA aid applicant who received one of the intercepted texts confirmed the message was authentic, as did a financial services firm whose messages appeared in the trove.
On its limited review, Reuters found nothing that appeared clearly classified or obviously sensitive, and found no chats belonging to Waltz or other Cabinet officials. Some content did touch on senior official movements. One Signal group was labeled "POTUS | ROME-VATICAN | PRESS GC" and appeared to concern logistics for a Vatican event. Another appeared to discuss a US officials' trip to Jordan.
That is the part worth sitting with. Absence of classified content does not mean absence of intelligence value. Travel logistics, event staging, press pool coordination, and the simple confirmation of which phone number belongs to which official are exactly the raw material a foreign service uses to build targeting packages.
Why It Matters
This incident is a case study in a failure mode that security teams routinely underweight: the compliance layer becomes the weakest link.
Signal's security properties come from end-to-end encryption, where plaintext exists only on endpoints. Recordkeeping law, however, requires that official communications be retained. TeleMessage's business model resolves that tension by extracting message content and shipping it to an archive. The moment that happens, the threat model changes completely. Message content now sits in a centralized, vendor-operated store, aggregated across many users and many agencies, and that store is a single high-value target. Breach it once and you get everyone.
Three consequences follow.
First, this is a supply chain exposure with cross-agency blast radius. No single agency's security program failed here. A third-party vendor was compromised, and the fallout landed on FEMA, CBP, State, the Secret Service and the Executive Office of the President simultaneously.
First-party controls do not protect data you have already handed to a vendor.
Second, identity mapping is the durable damage. Fragmentary messages age out of relevance in days. The binding of a verified phone number to a named federal official does not. That mapping enables SIM swap attempts, spear-phishing, smishing, and long-tail social engineering for years.
Third, the modified-client pattern deserves direct scrutiny. Deploying a third-party fork of a secure messenger means trusting a vendor's build, key handling, and archive infrastructure while inheriting none of the original app's audited guarantees. Users see the familiar Signal interface and reasonably assume Signal's protections apply. They do not.
The Attack Technique
The precise intrusion vector has not been confirmed publicly, and neither TeleMessage nor Smarsh has released technical detail. What the available reporting supports is a compromise of the archiving infrastructure itself rather than of Signal's protocol or of individual government devices. The attacker obtained archived message content across many users, which points at the server-side store or the service layer that writes to it, not at endpoint compromise.
Two structural weaknesses in this class of product are worth flagging as likely contributors, and as things to check in your own environment:
The archive is a plaintext aggregation point by design. Whatever encryption protects messages in transit between clients, the archiving function must possess readable content to store it. That content sat centralized and cross-tenant.
Public attention preceded the breach by days. The April 30 photograph put an obscure vendor in front of a global audience on April 30. The intrusion followed within roughly 72 hours. Sudden visibility is a targeting event, and vendors handling sensitive customers should treat unexpected media exposure as an operational security trigger, not a marketing win.
Reuters could not determine how each agency used TeleMessage, which itself indicates limited central visibility into where the product was deployed across government.
What Organizations Should Do
-
Inventory every archiving and compliance intermediary touching sensitive communications. Identify each product that decrypts, mirrors, or retains message content, name the vendor, and document where the resulting archive physically lives. You cannot defend an interception point you have not mapped.
-
Treat modified forks of secure messengers as distinct products with distinct threat models. A vendor build of Signal is not Signal. Require independent security assessment of the fork, its key management, and its archive backend before deployment, and communicate clearly to users that the app's original guarantees do not carry over.
-
Segment archives by tenant and by sensitivity, and encrypt at rest with customer-held keys. The cross-agency scope here is the direct product of aggregation. If a single compromise can yield 60+ users across six organizations, the storage architecture is the vulnerability.
-
Enforce contractual breach notification with hard timelines and technical detail. Push for 24 to 72 hour notification, mandatory disclosure of root cause and scope, and a right to independent forensic review. Vendor silence after an incident is itself an operational cost.
-
Run identity exposure remediation for affected personnel now. Assume official phone numbers are burned. Enable carrier-level port-out and SIM change locks, brief staff on smishing and voice pretexting, and consider number rotation for high-risk roles. This is the piece that outlives the news cycle.
-
Apply minimization at the source. Set retention floors rather than defaults, exclude categories of traffic that carry no recordkeeping obligation, and keep operational logistics such as travel and event coordination out of archived channels wherever policy permits. Data never captured cannot be stolen.
-
Add third-party media exposure to your vendor risk triggers. When a supplier handling your sensitive data receives sudden public attention, initiate an out-of-cycle security review and elevated monitoring immediately.
Sources: Hacker who breached communications app used by Trump aide stole data from across US government