01Summary
On 28 March 2026 the Handala persona, which Western governments tie to Iran's Ministry of Intelligence and Security, published photos and documents said to come from Kash Patel's personal email, reportedly dating to between 2010 and 2019. Handala said Patel "will now find his name among the list of successfully hacked victims". The FBI confirmed he had been targeted, said the data was "historical in nature and involves no government information", and said steps had been taken to mitigate risks. In the same period Handala claimed a destructive wiper attack on Stryker.
02Threat actor
Pro-Iranian hack-and-leak persona active since December 2023, assessed to be run by Iran's MOIS.
Aliases
- Handala
- Void Manticore
- Banished Kitten
- Red Sandstorm
03Victims and impact
Countries affected
- United States
04Data exposed
Data types
- Personal photos
- Personal documents
05Timeline
- 2026-03-28Handala publishes material from Patel's personal email.
06On the record
Will now find his name among the list of successfully hacked victims.
07Reaction and fallout
Geopolitical consequences
Part of Iran's wider cyber retaliation during the 2026 Iran war, which began on 28 February 2026.
08Disclosure and media
Publishing organisations
- The Hacker News
- FDD
10Sources
References
- [1]The Hacker News: https://thehackernews.com/2026/03/iran-linked-hackers-breach-fbi.html
- [2]Wikipedia: https://en.wikipedia.org/wiki/Handala_Hack_Team









