Loading story…
US Secretary of Defense Pete Hegseth violated Pentagon operational security protocols by sharing sensitive details about planned airstrikes on Houthi rebels in Yemen through a Signal chat group that included unauthorized participants, such as a journalist. The Pentagon Office of Inspector General (OIG) determined that the information, which included mission timelines and specifics about aircraft and munitions, was derived from a communication marked as SECRET//NOFORN and should have been handled at the secret level. Despite Hegseth's claim of declassifying the material, the OIG found that using a non-secure, consumer messaging app for such communications broke Department of Defense rules and posed a risk to US military operations.
The Inspector General's report, released to Congress and the public, recommended that US Central Command review and improve its classification procedures and provide additional training to senior officials on the proper use of electronic messaging systems. The incident, dubbed "Signalgate," highlighted broader issues within the Department of Defense regarding the use of non-DOD-controlled messaging platforms for sensitive communications and underscored the need for stricter adherence to secure communication protocols among top officials.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
The Inspector General recommended that USCENTCOM review classification and portion-marking procedures and that the Defense Department improve cybersecurity and messaging training for senior leaders. The report also urged broader reforms, including a DoD-controlled messaging service and a waiver process for public messaging apps.
By December 2025, a publicly released Pentagon Inspector General report concluded that Hegseth's transmission of sensitive operational information over Signal from a personal device did not comply with DOD policy governing nonpublic information and approved messaging systems. The report said the practice could have put troops and military operations at risk.
After being included in the group, Jeffrey Goldberg revealed that the Signal chat existed and that he had been added to it, bringing the incident into public view under the name 'Signalgate.'
During the March 2025 incident, then–national security adviser Michael Waltz mistakenly included The Atlantic editor-in-chief Jeffrey Goldberg in the Signal group chat where the strike details were shared. His presence exposed the existence of the chat to an outside journalist.
In March 2025, Defense Secretary Pete Hegseth used Signal on a personal phone to send sensitive, nonpublic operational details about planned US airstrikes on Houthi rebels in Yemen, including mission timing and information about aircraft and munitions. The information reportedly repeated content from a USCENTCOM email marked SECRET//NOFORN.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcego.theregister.com
Open sourcewired.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The US Department of Defense left confidential stream keys for its social media accounts publicly accessible on the DVIDS website for years, exposing them to potential hijacking. Attackers could have used these keys to take over official Pentagon livestreams on platforms like Facebook, X, and YouTube. The vulnerability, present since at least 2018, was only closed this week after media reports brought it to light.
Jun 29, 2026
The U.S. Department of Defense has confirmed that foreign adversaries used commercially available location data to target and surveil American military personnel in operational theaters, including the Middle East. A newly disclosed U.S. Central Command letter said it had received multiple threat reports involving hostile actors exploiting data collected from phones and computers through the advertising and data-broker ecosystem. Lawmakers led by Senator Ron Wyden and Representative Pat Harrigan said the disclosures amount to the first public confirmation that purchased commercial geolocation data was used against U.S. troops in active war zones, and warned that the ad-tech industry now poses a **national security threat**. The reports say Pentagon safeguards were insufficient: service members were allowed to use personal devices in operational areas, no policy required geolocation to be disabled in active war zones, and even government-issued devices did not fully block advertising-related tracking. Critics said the risk had been documented for years, citing contractor briefings dating back to 2016, demonstrations tracing personnel from U.S. bases to a covert site in Syria, and later studies showing brokers could easily sell sensitive data on service members. The Pentagon said it is moving to a new mobile device management system to better disable location services, but lawmakers warned that broader use of bring-your-own-device policies and weak regulation of data brokers continue to leave troops exposed.
Jun 29, 2026
A Department of Homeland Security audit found that U.S. Secret Service agents routinely used personal smartphones during foreign assignments because government-issued devices were too restricted for operational needs. Auditors said official devices often could not support basic tasks such as **WhatsApp** communication with foreign counterparts, internet research, group texting, or sending and receiving images, pushing personnel to use unmanaged personal devices despite policy prohibitions. The audit warned that this practice exposed communications, personnel, and protectees to interception, tracking, malware, and other compromise risks, while also identifying weaknesses in the agency’s own mobile security controls. Findings included delayed deployment of mobile threat defense software, failures to wipe devices after foreign travel as required, and inadequate security assessment of a third-party archived messaging app apparently referring to **TeleMessage**, which the Secret Service stopped using in May 2025; the agency agreed to five recommendations covering device management, training, overseas device security, app testing, and enforcement of the ban on personal device use.
Jun 29, 2026