A Signal-style messaging app used by Donald Trump’s former National Security Adviser Mike Waltz has been hacked, raising alarm over sensitive government data that may have leaked. An anonymous hacker gained access to TeleMessage, a third-party messaging platform designed to clone the interface and features of Signal while adding archiving capabilities, according to a report by 404 Media. The tool is reportedly used widely by the US government officials and agencies to comply with records retention requirements. However, the hack has exposed serious security flaws in how these archived messages are handled.
Although the hacker has not accessed any of Waltz’s messages or those exchanged by cabinet officials, the breach has exposed archived communications from other users of TeleMessage, including what appears to be data tied to government bodies such as Customs and Border Protection, as well as private firms like Coinbase. Screenshots reviewed by 404 Media show usernames, passwords, backend access panels, and snippets of chat content – all obtained through what the hacker described as an easily exploited vulnerability.
“I would say the whole process took about 15-20 minutes,” the hacker told 404 Media. “It wasn’t much effort at all.”
The hackers added that they broke in out of curiosity and did not report the issue to TeleMessage, claiming the company would likely “try their best to cover it up.”
The report states that the hacker was able to access the company’s backend panel using login credentials found in intercepted data. They were also able to view parts of chats sent via modified versions of other popular messaging apps, including WhatsApp, Telegram and WeChat.
Smarsh, the Portland-based firm that owns TeleMessage and is in the process of rebranding the app as Capture Mobile, has not yet responded to requests for comment. Neither has Waltz nor the White House.
Signal, known for its robust end-to-end encryption, distanced itself from the cloned app, with a spokesperson telling Reuters earlier that it “cannot guarantee the privacy or security properties of unofficial versions of Signal.”
Waltz came under public scrutiny last week after a Reuters photo showed him using TeleMessage during a cabinet meeting with former President Trump. His dismissal on Thursday followed weeks of controversy around a Signal group he reportedly created to share real-time updates on US military activity in Yemen. The group became the centre of attention when someone – either Waltz or another member – accidentally added a prominent journalist to the chat.
The incident has cast fresh doubts on the use of modified, archive-enabled versions of secure apps in high-level government settings. While the added features are intended to help preserve official records, they may inadvertently create new points of vulnerability – especially if those systems are poorly protected.
“If I could have found this in less than 30 minutes,” the hacker warned, “then anybody else could too. And who knows how long it’s been vulnerable?”