Iranian Hackers Handala Breach FBI Director Kash Patel's Personal Gmail: What Was Released
The hacktivist group Handala, linked to the Iranian Ministry of Intelligence and Security (MOIS), has breached the personal Gmail account of FBI Director Kash Patel. According to Bleeping Computer, a purported curriculum vitae, a sample of emails extracted from the account, and private photographs have been published online. The FBI has confirmed the incident, clarifying that the stolen data is "historical in nature" (which simply means the data is old, dating back to the past) and does not contain any governmental information.
What Was Exfiltrated
The emails made public by Handala on Telegram and its own site range from 2011-2012 to 2022, according to analyses by CNN and Politico conducted with independent cybersecurity experts. The contents include personal, professional, and travel correspondence of Patel from the years before his appointment as FBI director, which took place in February 2025.
Despite Handala's claims of having compromised the FBI's "impenetrable systems" in just a few hours, the access solely pertains to a private Gmail account. The FBI's official statement—obtained by BleepingComputer—states: "The FBI is aware of malicious actors who have targeted the personal email account information of Director Patel, and we have taken all necessary measures to mitigate potential risks associated with this activity. The information in question is of historical nature and does not pertain to any governmental information."
The Retaliation and Timing of the Attack
Handala claimed the operation as a direct retaliation for two U.S. actions: the seizure of its domains by the U.S. Department of Justice on March 19, 2026, and the offer of $10 million for anyone who provides useful information to identify the group's members. A significant technical detail: according to CBS News, the domain used in the attack against Patel was registered on the same day as the DOJ's seizure, an almost instantaneous response to the law enforcement operation.
The geopolitical context is relevant: the escalation of Iranian cyber operations followed the U.S.-Iran conflict that began on February 28, 2026. Before the attack on Patel, Handala had already heavily targeted the Microsoft environment of Stryker, a U.S. medical devices giant, with a destructive attack claimed on March 11. The DOJ's domain seizure on March 19 explicitly cited that attack as the basis for the legal action.
Who is Handala
Active since December 2023, Handala, also known as Handala Hack Team, Hatef, and Hamsa, operates as a hacktivist group on behalf of the Iranian MOIS. Check Point Research tracks it under the cluster Void Manticore, with previous operations against Israel and Albania before shifting focus to U.S. targets. In July 2025, Iran International publicly identified one of the group's administrators, Ali Bermoode, 27, connecting him to an official in the Ministry of Intelligence. The DOJ, in the seizure proceedings, describes the group’s domains as infrastructure for psychological operations: among the main operations are the publication of stolen data, threats to Iranian dissidents and journalists, and discredit campaigns against regime opponents.
Handala is a character created in 1969 by Palestinian cartoonist Naji al-Ali, first appearing in the Kuwaiti newspaper Al-Seyassah. He is depicted as a 10-year-old boy, barefoot, in tattered clothes and scruffy hair, always shown from behind, with his hands clasped behind his back. The face is never shown: according to al-Ali, it will only be revealed when Palestinian refugees can return to their homeland.
The Iranian collective has deliberately adopted this name and iconography, presenting itself as the voice of the "resistance" against Israel and the West. It is a political positioning choice: to appropriate a symbol universally recognized in Arab culture to legitimize its operations as acts of resistance, not as cyber crimes. Al-Ali was assassinated in London in 1987, likely by Mossad agents, an additional element that the group narratively exploits.