Loading story…
Suspected Iranian state-linked hackers infiltrated the personal AOL email account of former U.S. national security adviser John Bolton in 2021, gaining access to sensitive documents and threatening to leak their contents. The hackers reportedly sent extortionate messages referencing the potential for a scandal similar to the 2016 Hillary Clinton email controversy, and Bolton's representative notified the FBI about the intrusion. Prosecutors allege that Bolton used the compromised account to transmit classified information to family members, which may have been obtained by the hackers.
Following the breach, the U.S. Department of Justice charged Bolton with mishandling classified information, specifically for retaining and transmitting sensitive material via his personal email. The indictment, unsealed in October 2025, details the sequence of events and the security lapses involved, raising concerns about the use of personal email accounts for official business by high-ranking government officials. Bolton has denied any wrongdoing and called the charges baseless, while questions remain about the security measures in place on his email account at the time of the breach.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
U.S. authorities charged John Bolton after classified emails were discovered in the compromised AOL account following the Iranian intrusion. Multiple reports described the charge as stemming from the exposure of sensitive messages in the hacked mailbox.
The U.S. Justice Department said Iranian hackers compromised former National Security Adviser John Bolton's AOL account. The breach exposed emails that included classified information, forming the basis for later criminal charges.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran-linked hackers operating as **Handala** claimed they breached FBI Director Kash Patel’s personal Gmail account and published personal photographs, documents, and a sample of more than 300 emails online. Multiple reports said the exposed messages dated from roughly 2010 to 2019, and people familiar with the leak, along with technical review of some email signatures, indicated at least part of the material appeared authentic. Distributed Denial of Secrets was reported to have published what it said was Patel’s email cache, while some leaked messages reportedly showed communications involving a former Justice Department email account. The FBI confirmed that Patel’s personal email had been targeted, said it took mitigation steps, and maintained that the exposed material was historical and did not include government or classified information or indicate a compromise of FBI networks. Handala said the intrusion was retaliation for U.S. actions against the group, including FBI seizures of domains tied to its operations and a **$10 million** State Department reward offer for information on its members. The incident fits a broader pattern of Iranian-aligned **hack-and-leak** activity that has also included claimed operations against **Stryker**, **Lockheed Martin**, and other U.S.-linked targets.
Jun 29, 2026
Iran-linked hackers operating as the **Handala Hack Team** claimed they breached FBI Director Kash Patel’s personal Gmail account and published excerpts from the stolen material online. Reporting says the leak totaled about **800 MB** and included personal photographs, a purported resume, and hundreds of emails, with exposed correspondence spanning roughly **2010 to 2019** and appearing to contain both personal and work-related messages. A Justice Department official confirmed Patel’s email account had been compromised and said the leaked material appeared authentic, though the emails themselves were not independently verified. Handala framed the intrusion as an embarrassment for U.S. security leadership and warned that if the FBI director could be compromised, other personnel could be targeted as well. Western cybersecurity researchers have assessed Handala as a pro-Palestinian hacktivist persona linked to **Iranian government cyberintelligence units**, and the breach follows other activity attributed to the group, including a claimed attack on medical technology company **Stryker**. The incident also comes after U.S. actions against Handala, including domain seizures and a **$10 million** reward offer tied to identifying members of the group.
Jun 29, 2026
A pro-Iranian hacking group calling itself **Handala** claimed responsibility for compromising a personal account belonging to FBI Director **Kash Patel** and posted what appeared to be old personal photographs, a résumé, and other personal documents online. The FBI said malicious actors targeted Patel’s personal email information and that it had taken mitigation steps, adding that the exposed material was historical and did not include government information. Reporting said Patel had previously been notified by the FBI in December 2024 that he was a target of an Iranian hacking operation before he became FBI director. U.S. authorities have described Handala as a pro-Iranian, pro-Palestinian proxy actor linked to prior operations against U.S. officials, and the government is offering up to **$10 million** for information that helps identify the group’s members; the group has also recently claimed responsibility for disrupting **Stryker** systems.
Jun 29, 2026