Iran-linked hackers claim breach of FBI director's personal email account.

Summary

By the N2K CyberWire staff

Iran-linked hackers claim breach of FBI director's personal email account.

The US Federal Bureau of Investigation (FBI) has confirmed a breach of FBI Director Kash Patel's personal Gmail account, noting that the compomised data is "historical in nature and involves no government information," SecurityWeek reports. The Iran-linked hacking group Handala claimed responsibility for the breach, publishing photos and emails allegedly stolen from the account. The emails date from between 2010 and 2019, consisting of a mix of personal and professional correspondence, according to Reuters.

Handala presents itself as an independent hacktivist group, but experts believe the threat actor is tied to Iranian intelligence services. The US government has stated that the group operates under the direction of Iran's Ministry of Intelligence and Security (MOIS). Handala has been increasingly active since the outbreak of war on February 28th; the gang also claimed responsibility for a disruptive attack against US medical technology company Stryker earlier this month.

Threat actors exploit critical F5 BIG-IP vulnerability.

F5 Networks has reclassified a BIG-IP Access Policy Manager denial-of-service flaw as an unauthenticated remote code execution vulnerability, raising its severity score from 7.5 to 9.8. The vulnerability (CVE-2025-53521) is being actively exploited, and organizations are urged to apply fixes as soon as possible.

The UK's National Cyber Security Centre (NCSC) has published an advisory on the vulnerability, recommending that organizations "[investigate] for compromise on all affected products regardless of when the system was updated."

European Commission discloses breach.

The European Commission has disclosed a data breach affecting the AWS environment that hosts the Commission's Europa.eu web platform. BleepingComputer says the ShinyHunters extortion group has taken credit for the attack, claiming to have stolen over 350 GB of data.

The Commission said in a statement, "Early findings of our ongoing investigation suggest that data have been taken from those websites. The Commission is duly notifying the Union entities who might have been affected by the incident. The Commission's services are still investigating the full impact of the incident. The Commission's internal systems were not affected by the cyber-attack."

Notes.

Today's issue includes events affecting the European Union, Iran, and the United States.

Selected Reading

Attacks, Threats, and Vulnerabilities

Critical Citrix NetScaler Vulnerability Exploited in the Wild (Infosecurity Magazine) Researchers from watchTowr and Defused have found evidence that attackers are actively exploiting CVE-2026-3055, a critical NetScaler vulnerability

Russian APT Star Blizzard Adopts DarkSword iOS Exploit Kit (SecurityWeek) The state-sponsored group’s campaign has targeted government, higher education, financial, and legal entities, as well as think tanks.

New Infinity Stealer malware grabs macOS data via ClickFix lures (BleepingComputer) A new info-stealing malware named Infinity Stealer is targeting macOS systems with a Python payload packaged as an executable using the open-source Nuitka compiler.

Legislation, Policy, and Regulation

US Treasury Weighs Cyber Insurance Backstop (GovInfoSecurity) A Department of the Treasury review of cyber risk under the Terrorism Risk Insurance Program comes amid concern that nation-state attacks and systemic cyber events

Litigation, Investigation, and Law Enforcement

DHS drops investigation into former acting CISA chief’s failed polygraph exam (Nextgov.com) “We are pleased that the CISA personnel punished by previous DHS and CISA leadership for doing their jobs have been cleared of wrongdoing and invited back to work, as we demanded three months ago,” said a joint statement from Democratic Reps. Bennie Thompson and Eric Swalwell.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

SO-CON 2026 (Arlington, Virginia, USA, Apr 13 - 14, 2026) SO-CON is the only conference dedicated to identity-based security and attack path management. The week begins with a two-day main conference packed with talks, research, and community exchange, followed by four days of deep-dive, hands-on trainings led by adversary-experienced practitioners. Training to follow on April 15-18, 2026.

Space Symposium 2026 (Colorado Springs, Colorado, USA, Apr 13 - 16, 2026) Space Symposium is the premier event uniting global space professionals from all sectors, providing a unique platform to explore critical space issues, foster dialogue, and drive innovation across the space industry.

Philadelphia Cybersecurity Summit (Philadelphia, PA, Apr 15, 2026) Maximize your networking opportunities by meeting with fellow industry executives and leading security experts at the upcoming 9th Annual Philadelphia Official Cybersecurity Summit on Wednesday, April 15, 2026. Secure your admission now! Use Code CSS26-CRA before February 18 for Free Admission.*

CyberArk IMPACT 2026 (Austin, Texas, USA, May 11 - 13, 2026) At CyberArk IMPACT, cybersecurity practitioners and leaders will come together to explore today’s #1 attack vector – identity. Attendees will acquire a deep understanding of the latest developments in identity-based cyberattacks, including sophisticated attacker techniques that leverage AI and other methods. And most importantly, they will learn how to shut out attackers and prevent unauthorized access by securing every identity across the organization with the right level of privilege controls.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 03.30.26

Top stories.

Iran-linked hackers claim breach of FBI director's personal email account.

Threat actors exploit critical F5 BIG-IP vulnerability.

European Commission discloses breach.

Notes.

Attacks, Threats, and Vulnerabilities

Legislation, Policy, and Regulation

Litigation, Investigation, and Law Enforcement

Events