The modified Signal app used by Mike Waltz was reportedly hacked

A hacker has obtained direct messages and contact information from TeleMessage, the Israeli software company that offers modified versions of Signal, WhatsApp, Telegram, and other apps to the US government, according to a report from 404Media. Last week, a photo of former National Security Advisor Mike Waltz appeared to show him using a Signal clone offered by the company.

TeleMessage lets users archive their chats in secure messaging apps. The hacker found that TeleMessage’s archived chat logs aren’t end-to-end encrypted, allowing them to access the contents of certain messages, government official contact information, and login credentials for the service’s backend.

Though the hacker didn’t obtain messages from Waltz or other cabinet members, screenshots of the stolen data seen by 404 Media show the names, phone numbers, and email addresses of Customs and Border Protection officials. When 404 Media called some of these phone numbers, one person reportedly said their name was the same as the information in the hacked data, while another’s voicemail recording also contained a matching name.

The communication services used by government officials have been the subject of increased attention after Waltz inadvertently added the editor-in-chief of The Atlantic to a Signal group chat discussing military strikes on Yemen in March. US Defense Secretary Pete Hegseth shared details about the strikes in a separate Signal that included his wife and “about a dozen” other people, according to The New York Times.

After Waltz was spotted using TeleMessage, 404 Media found that the company “wiped its website,” which previously “contained details on the services it offers, what its apps were capable of, and in some cases direct downloads for the archiving apps themselves. The hacked data also reportedly included information about crypto exchange Coinbase and Scotiabank.

The Verge reached out to TeleMessage’s parent company, Smarsh, with a request for more information but didn’t immediately hear back.