FBI confirms Iran-linked Handala hackers leaked Director Kash Patel's personal emails
Iran-linked Handala leaked photos and old emails from FBI Director Kash Patel's personal account. The FBI says no government data was involved. Lessons here.
On 27 March 2026 the FBI confirmed that hackers had obtained material from Director Kash Patel's personal email account. The material was leaked by Handala, a hack-and-leak persona US authorities link to Iran's Ministry of Intelligence and Security (MOIS). The FBI says the material is old and contains no government information. The case still matters to engineering and security teams: personal accounts belonging to high-profile staff are among the easiest ways into an organisation.
What happened
Handala posted photos and documents it said came from Patel's personal inbox, including routine emails from 2010 and 2019. The Justice Department told Reuters the account had been breached and the documents appeared authentic. An FBI spokesperson said the information was "historical in nature and involves no government information" and that the bureau had "taken all necessary steps to mitigate potential risks". It hasn't said how the account was accessed.
Handala presented the leak as retaliation, including for FBI action the previous week: the Justice Department had seized four domains allegedly used in MOIS operations since 2022 (including Handala-branded leak sites), and a $10 million reward had been offered for information on the group. The FBI said that reward still stands and that Handala "has frequently targeted U.S. government officials". The group had quickly put up replacement sites and, around the same time, claimed other leaks targeting US defence-industry staff.
Who is affected
- Kash Patel and the people whose correspondence appears in the leaked emails.
- According to the FBI, no government systems or data were affected.
- More broadly, any executive, official or senior engineer whose old personal email account still holds years of history.
What it means for developers and engineering teams
Hack-and-leak operations don't need a corporate breach. A personal webmail account with an old reused password, weak recovery options or a forgotten OAuth grant can be enough. Because no one knows yet how Patel's account was compromised, the useful lessons are general ones.
First, old data is a liability. Emails from 2010 and 2019 had no operational value to their owner, but they were enough for a propaganda win. Second, personal accounts sit outside your controls. Corporate MFA policies, conditional access and logging don't cover a leader's personal Gmail, which may still be the recovery address for other accounts, including work-related ones. Third, state-linked groups pick targets for symbolic value, so the people most visible in the news are the most likely targets, whatever their access.
For engineering organisations this goes beyond executives. Maintainers of popular projects, holders of admin rights in cloud or source control, and on-call engineers are targeted the same way. Their personal accounts often recover the developer identities that matter.
What to do now
- Enroll high-risk people in stronger account protection. For Google accounts that means passkeys or security keys and, for prominent individuals, Google's Advanced Protection Program.
- Review account recovery: remove old phone numbers and backup emails, and make sure personal accounts aren't the recovery route for work identities.
- Audit third-party access at the account's security settings (connected apps and OAuth grants), plus any forwarding rules and app passwords.
- Reduce what's stored: archive offline or delete years of old mail that no longer serves a purpose.
- Keep work and personal separate. Never use personal accounts for work documents or as the login for company tools.
- Plan for leaks: agree in advance who confirms or denies authenticity and how, because hack-and-leak campaigns depend on confusion.
Related on TechLogHub
- Authentication: passkeys, MFA and account recovery
- OAuth: the third-party grants worth auditing