Pro-Iran hackers published more than 300 emails and photos Friday from what appears to be the personal email account of FBI Director Kash Patel.
In a statement, an FBI spokesman acknowledged the Iranian operation. “The FBI is aware of malicious actors targeting Director Patel’s personal email information, and we have taken all necessary steps to mitigate the potential risks associated with this activity. The information in question is historical and does not constitute government information,” said a spokesperson.
The hacker group, called Handala, said on its website that the leak was in retaliation after the FBI and Justice Department seized several of its websites last week, accusing the group of “psychological operations” and saying it was a site for Iran’s Ministry of Intelligence and Security. The State Department has offered a reward of up to $10 million for information on Iranian hackers who threaten critical US infrastructure.
Earlier this month, Handala took credit for the only significant cyberattack against an American company, medical technology supplier Stryker, since the war between Iran and the US and Israel began.
NBC News has not legally verified all emails as genuine.
The group published on its website several photos of Patel that do not appear to have been made public, according to an NBC News review of several image searches. The hacked emails appear to have been sent from or to a personal Gmail account listed as Patel’s in at least one public government document. Gmail did not respond to a request for comment.
Handala posted on his Telegram channel on Thursday that the FBI “shouldn’t have started conflicting and conflicting with us.” It also said it would soon send evidence of “the biggest security breach of the last decade.” That Telegram channel has been deleted. Telegram did not respond to a request for comment.
All of the emails predate Patel’s work with the Trump administration, and metadata from the files show they were hacked before the war began. The emails sent by Handala have been selected and organized into folders that were last modified on May 21, 2025. Most of the emails are between 2010 and 2012, and the most recent is a 2022 airline ticket receipt.
Many of the emails are personal and include communications between Patel’s family and photographs of her children when they were young. Others are the Patels who appear to be on a trip to Cuba.
US officials told Patel in late 2024 that he had been the victim of an Iranian cyberattack before he agreed to lead the FBI, and that hackers wanted to contact him.
Ahead of the 2024 election, the FBI, Microsoft and Google say hackers working for Iran’s Revolutionary Guard Corps attempted to hack several political figures, including officials of Donald Trump and Joe Biden during his re-election bid.
Hackers don’t appear to have leaked files from Democrats. But a hacker calling himself “Robert” approached several news outlets, including NBC News, with hacked documents examining Trump’s three top vice presidential picks before Election Day. NBC News and several other news outlets declined to publish the files and did not see any new information in them.
The Robert persona told Reuters in 2025 that he planned to release many of the emails he had stolen from Trump associates, although it is not clear if that happened. The Signal account formerly used by Robert’s persona did not respond to a request for comment from NBC News.
Handala often takes credit for hacking companies and posts some hacked files on their site. Sometimes it exaggerates what it says. Earlier this month, it said it hacked Verifone, an Israeli telecommunications company, although a Verifone spokesperson told NBC News that it had not experienced any attacks or disruptions to its systems.
Alex Orleans, head of threat intelligence at cybersecurity firm Sublime Security, told NBC News that Iran appears to have hacked Patel in the past and is strategically waiting to release the files.
“It looks like they were sitting on something,” Orleans said. “Iranian actors live in all kinds of problems and end up on a rainy day.”
“Given the recent controversies involving Patel, I expect the Iranians would have chosen to release more recent – and potentially embarrassing – content if they had an open line of access than they had on the shelf,” he said.
