TeleMessage: An Altered Signal Replica Utilized by US Government Officials Compromised

An unidentified individual took advantage of a vulnerability in TeleMessage, a provider of modified versions of encrypted messaging applications like Signal, Telegram, and WhatsApp, to access stored messages and other information concerning U.S. government officials and companies utilizing the service, as reported by 404 Media. TeleMessage gained attention recently when it was disclosed that former U.S. national security advisor Mike Waltz was utilizing TeleMessage’s altered Signal version. TeleMessage, headquartered in Israel and owned by Smarsh, furnishes clients with a means of archiving messages, including voice notes, from encrypted applications.

The compromised data did not compromise the messages of cabinet members and Waltz, according to 404 Media, but it did include message contents, contact details of government officials, back-end login credentials for TeleMessage, and more. The hacker extracted data from U.S. Customs and Border Protection, cryptocurrency exchange Coinbase, and financial institutions like Scotiabank, as indicated in the report.

The breach exposed that the stored chat logs are not end-to-end encrypted between the modified Signal version provided by TeleMessage and the final storage location for the messages, 404 Media stated. Smarsh, the parent company of TeleMessage, informed TechCrunch in a statement that it had suspended TeleMessage’s services and is looking into a potential security issue. The statement mentioned, “Upon detection, we acted swiftly to contain it and enlisted an external cybersecurity firm to aid our investigation. As a precautionary measure, all TeleMessage services have been temporarily halted, while all other Smarsh products and services continue to operate normally.”

A representative from Coinbase stated that the organization is closely monitoring the situation and assessing its impact on Coinbase. At present, there is no indication that any sensitive customer information from Coinbase was accessed or that customer accounts are in jeopardy since Coinbase does not utilize this tool for sharing passwords, seed phrases, or other data required to access accounts.

Tech and VC heavyweights have been added to the Disrupt 2025 agenda. Signal, U.S. Customs and Border Protection, and Scotiabank did not respond immediately to requests for comments.

This update includes statements from Smarsh and Coinbase.