An Iran-linked hacking group has claimed responsibility for breaching the personal email account of FBI Director Kash Patel, publishing what it says are private communications, documents and images on its leaked website.
The group, known as the Handala Hack Team, posted a message alongside the data, declaring:
“<a href="https://www.thestreet.com/crypto/policy/trumps-new-fbi-director-kash-patel-is-a-bitcoiner" rel="noopener noreferrer nofollow">Kash Patel,</a> the current head of the FBI … will now find his name among the list of successfully hacked victims.”
<a href="https://www.thestreet.com/crypto/business/hackers-attack-trump-backed-crypto-project" rel="noopener noreferrer nofollow">Related: Hackers attack Trump-backed crypto project</a>
It further claimed that “all personal and confidential information of Kash Patel, including emails, conversations, documents, and even classified files, is now available for public download.”
The post, written in a confrontational tone, also mocked U.S. cybersecurity capabilities, stating:&nbsp;
“This is the security that the U.S. government boasts about?!”
A Justice Department official confirmed to Reuters that Patel’s personal email had been breached and said the material published online appeared authentic, though the full extent of the intrusion remains unclear.
TheStreet <a rel="noopener noreferrer nofollow">Roundtable</a> reached out to the DOJ and FBI to verify the authenticity of the images, but haven’t received a response at the time of publishing.
<h2 id="what-was-published-online">What was published online</h2>
The leak was distributed through a page hosted on infrastructure associated with the Handala group, where files labeled as proof-of-compromise (“POC”) were made available for download.
<figure><img src="https://www.thestreet.com/.image/c_fit%2Ch_800%2Cw_1200/MjIyMjQ5MzUzNjUyMjE3NzE4/image-27-03-26-at-945pm.png" height="545" width="1200">
 <figcaption>
 Excerpt from Handala Hack Team’s statement following the alleged breach of FBI Director Kash Patel, published on its leak platform.
 </figcaption>
</figure>
A review of the material shows a mix of emails, documents and personal images allegedly tied to Patel. The images appear to include older photographs, including what looks like a younger version of Patel, alongside informal and personal snapshots.
TheStreet Roundtable has chosen not to publish or directly link to the images, as they appear to be personal in nature and not in the public interest. However, the content suggests that the breach extends beyond professional correspondence and into private data.
Reuters separately reported that the exposed emails appear to span multiple years, including both personal and work-related communication.
<h3 id="most-popular-on-thestreet-roundtable">Most popular on TheStreet Roundtable:</h3>
<ul>
 <li><a href="https://www.thestreet.com/crypto/investing/5-star-analyst-sets-massive-150000-target-for-bitcoin" rel="noopener noreferrer nofollow">5-star analyst sets massive $150,000 target for Bitcoin</a></li>
 <li><a href="https://www.thestreet.com/crypto/investing/morgan-stanley-backed-crypto-stock-gets-86-upside-target" rel="noopener noreferrer nofollow">Morgan Stanley-backed crypto stock gets 86% upside rating</a></li>
 <li><a href="https://www.thestreet.com/crypto/markets/cathie-wood-offloads-peter-thiel-backed-crypto-stock-twice-in-row" rel="noopener noreferrer nofollow">Cathie Wood sells Peter Thiel-backed crypto stock twice in a row</a></li>
</ul>
<h2 id="security-researcher-reveals-breach-not-new">Security researcher reveals breach not new</h2>
Rajshekhar Rajaharia, an independent cybersecurity researcher, told TheStreet Roundtable that the breach may not be entirely new and could be linked to older data exposures.
<blockquote>
 “This appears to be old data resurfacing rather than a fresh breach,” Rajaharia said. “A lot of email-password combinations were exposed in earlier data breaches, especially before 2020, when security standards were weaker. It’s possible the attackers are repackaging that information now.”
</blockquote>
Notably,&nbsp;Patel was not the FBI Director at the time of the alleged emails. In 2020, he served as a senior national security official, including roles at the National Security Council and later as chief of staff to the acting U.S. Secretary of Defense.
<figure>
 <figcaption>Kash Patel, Director of the U.S. Federal Bureau of Investigation (FBI).
 </figcaption>
</figure>
He added that such leak campaigns are often designed to attract attention and drive downloads.
<blockquote>
 “Groups like this publish ‘proof-of-compromise’ files to get people to click and download. But users should be cautious, these files can also be used to distribute malicious software,” he said.
</blockquote>
Rajaharia also noted that while Handala presents itself as a pro-Palestinian group, its origins are less clear.
<blockquote>
 “These groups can be state-linked or operate independently” he said.
</blockquote>
He warned users against interacting with leaked files directly.
<blockquote>
 “If you’re downloading anything from such sites, you should first scan it using secure tools or sandbox environments. The simplest rule is: don’t trust these files, even the attackers can embed malicious content themselves.”
</blockquote>
<h2 id="who-is-handala">Who is Handala?</h2>
Handala presents itself as a pro-Palestinian hacktivist group, but cybersecurity researchers widely believe it is linked to Iranian state-backed cyber operations.
The group has increasingly used its website as a leak platform, publishing stolen data alongside political messaging tied to the Israel-Iran conflict. Its activity in recent weeks suggests a shift toward targeting high-profile individuals rather than purely corporate systems.
Unlike financially motivated cybercriminal groups, Handala’s operations appear focused on psychological impact and information warfare, using leaks to undermine trust in institutions.
Handala’s activity has intensified in recent weeks, with the group claiming a series of high-profile cyber intrusions.&nbsp;
On March 11, it said it breached the U.S.-based medical technology firm Stryker, alleging it had deleted a significant volume of corporate data, though the claim was not independently verified.&nbsp;
Beyond these incidents, Handala has continued to run ongoing leak campaigns throughout 2026, frequently posting so-called “proof-of-compromise” files and partial data dumps tied to Western-linked entities.
<h2 id="how-this-compares-to-other-cyber-groups">How this compares to other cyber groups</h2>
While Handala’s tactics involve public leaks and messaging, they differ from groups like North Korea’s Lazarus Group, which is primarily financially motivated and has been linked to large-scale cryptocurrency thefts.
Lazarus has been accused of stealing billions of dollars in crypto assets through exchange hacks and exploits, often laundering funds through decentralized finance platforms.
Handala, by contrast, appears less focused on direct financial gain and more aligned with state-linked influence operations.
<a href="https://www.thestreet.com/crypto/markets/hackers-swipe-20-million-in-crypto-from-u-s-government-wallets" rel="noopener noreferrer nofollow">Related: Hackers swipe $20 million in crypto from U.S. government wallets</a>

Exclusive: Security researcher reveals new details on FBI Director Kash Patel’s account breach

Table of Contents

TheStreet Roundtable

Other articles published on Mar 27, 2026

Join our free newsletter for daily crypto updates!