You have 0 free articles left this month.
Register for a free account to access unlimited free content.

Powered by MOMENTUMMEDIA

Breaking news and updates daily. Subscribe to our Newsletter

Hack.gov: TeleMessage data breach published by DDoSecrets

Following a hack of the Signal-clone used by top US officials, 410 gigabytes of archived messages have been published online by a pro-transparency not-for-profit.

Hack.gov: TeleMessage data breach published by DDoSecrets
expand image

The contents of a data breach impacting a messaging app used by senior United States government officials have been published online by radical pro-transparency outfit Distributed Denial of Secrets (DDoSecrets).

Israel-based TeleMessage was hacked on 4 May, with chat logs archived by the company’s Signal clone, TM SGNL, exposed in the breach.

TeleMessage and its TM SGNL product hit the headlines just days before when it was revealed that former national security adviser Mike Waltz was continuing to use the app, despite the leak of a seemingly secure chat between Waltz and other senior officials regarding air strikes against Houthi rebels in Yemen.

However, the use of TeleMessage by the US government predates the current Trump administration, with one contract dating back to at least 2023.

The issue that the hacker – there were, in fact, two hacks within days, most likely taking advantage of the same vulnerability – was able to exploit was the lack of end-to-end encryption in the modified app.

Now, 410 gigabytes of data obtained from the breach, including “thousands of heap dumps” has been published online.

“Some of the archived data includes plaintext messages while other portions only include metadata, including sender and recipient information, timestamps, and group names,” DDoSecrets said in a 19 May post to its web archive.

“To facilitate research, Distributed Denial of Secrets has extracted the text from the original heap dumps.”

While the data is now online, DDoSecrets is playing it safe due to the inclusion of personally identifiable data belonging to individuals and groups “unrelated to government or corporate behaviour”.

Journalists and valid researchers, however, are able to request access to the dataset.

David Hollingworth

David Hollingworth

David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.

You need to be a member to post comments. Become a member for free today!

newsletter
cyber daily subscribe
Be the first to hear the latest developments in the cyber industry.