Private Data, Passwords of Senior US Security Officials Found Online

Private contact details of the most important security advisers to U.S. President Donald Trump can be found on the internet. DER SPIEGEL reporters were able to find mobile phone numbers, email addresses and even some passwords belonging to the top officials.

To do so, the reporters used commercial people search engines along with hacked customer data that has been published on the web. Those affected by the leaks include National Security Adviser Mike Waltz, Director of National Intelligence Tulsi Gabbard and Secretary of Defense Pete Hegseth.

Most of these numbers and email addresses are apparently still in use, with some of them linked to profiles on social media platforms like Instagram and LinkedIn. They were used to create Dropbox accounts and profiles in apps that track running data. There are also WhatsApp profiles for the respective phone numbers and even Signal accounts in some cases.

As such, the reporting has revealed an additional grave, previously unknown security breach at the highest levels in Washington. Hostile intelligence services could use this publicly available data to hack the communications of those affected by installing spyware on their devices. It is thus conceivable that foreign agents were privy to the Signal chat group in which Gabbard, Waltz and Hegseth discussed a military strike.

Numbers Linked to Signal Accounts

It remains unclear, however, whether this extremely problematic chat was conducted using Signal accounts linked to the private telephone numbers of the officials involved. DER SPIEGEL reporting has demonstrated, though, that privately used and publicly accessible telephone numbers belonging to her and Waltz are, in fact, linked to Signal accounts.

The U.S. newsmagazine The Atlantic revealed on Monday that Gabbard, Waltz and Hegseth, along with CIA Director John Ratcliffe and additional officials, discussed an imminent military strike against the Houthi militia in Yemen in a Signal chat. The information shared among the participants included intelligence information and precise attack plans. According to the Atlantic, Waltz added the editor-in-chief of the magazine, Jeffrey Goldberg, to the chat group. Precisely why he did so remains unclear.

The White House confirmed the scandal after the fact. Trump insisted that it did not include classified content, a question that is of particular relevance since members of the U.S. government are not permitted to share such information over Signal. The U.S. special envoy for Ukraine and the Middle East, Steve Witkoff, was even in Russia while participating in the chat group.

DER SPIEGEL was able to find some of the contact information for Gabbard, Hegseth and Waltz in commercial databases, while other information was in so-called password leaks, which are hardly a rarity on the internet. One example is the 2019 discovery by Troy Hunt, who found 773 million email addresses and more than 21 million passwords in a hacker forum.

Since then, there have been numerous additional leaks. Criminals are constantly compiling new collections from hacks, usually to sell them on forums.

It was particularly easy for DER SPIEGEL reporters to discover Hegseth’s mobile number and email address. They turned to a commercial provider of contact information that is primarily used by companies for sales, marketing and recruitment.

DER SPIEGEL sent the provider a link to Hegseth’s LinkedIn profile and received a Gmail address and a mobile phone number in return, in addition to other information. A search of leaked user data revealed that the email address and, in some cases, even the password associated with it, could be found in over 20 publicly accessible leaks. Using publicly available information, it was possible to verify that the email address was used just a few days ago.

The mobile number provided, meanwhile, led to a WhatsApp account that Hegseth apparently only recently deleted. The profile photo showed a shirtless Hegseth in a baseball cap and necklace. Comparisons with other photos of the U.S. secretary of defense using facial recognition software were able to confirm that the photo on the WhatsApp profile was indeed Hegseth.

Several Passwords in Leaked Database

Waltz’s mobile number and email address could be found using the same service provider. The mobile phone number could even be found using a people search engine popular in the U.S. DER SPIEGEL reporters were also able to find several passwords for Waltz’s email address in leaked databases. The information also led to Waltz’s profiles for Microsoft Teams, LinkedIn, WhatsApp and Signal.

National Intelligence Director Gabbard was seemingly more careful with her data than her two male colleagues. She apparently had her own data blocked in the commercial contact search engines that contained the data of Hegseth and Waltz. But her email address was to be found on WikiLeaks and Reddit.

Gabbard’s email address is available in more than 10 leaks. One of those also contains a partial telephone number, which, when completed, leads to an active WhatsApp account and a Signal profile.

"Exposed data from top politicians can be used by hackers to launch convincing phishing attacks and gain access to devices and various services such as email, chat tools and PayPal,” says Donald Ortmann, a specialist in information security, information procurement and social engineering. He supports companies and authorities following cyberattacks.

"In addition, deepfake attacks using images and sound available online can be launched to participate in virtual meetings,” says Ortmann. Compromised accounts also enable hackers to "install malware, monitor communications and attempt political blackmail.”