FBI Can't Protect Its Own Surveillance Data From Chinese Hackers

TL;DR: On April 1, the FBI formally classified a suspected Chinese hack of its surveillance systems as a "major incident" under FISMA, the most serious cybersecurity designation a federal agency can make. Hackers breached an FBI system containing wiretap data, pen register returns, and personal information about people under active investigation. It's the first time the FBI has declared a major cyber incident on its own networks since at least 2020. The breach exploited a commercial ISP vendor's infrastructure, the same playbook as Salt Typhoon. Section 702 expires April 20. The bureau is asking Congress to renew its warrantless search powers while admitting it can't protect the data it already collects.

From "Suspicious Activity" to "Major Incident"

We first covered this breach on March 6, when the FBI notified Congress about "suspicious activities" on an internal network. At the time, attribution was uncertain and the scope was unclear.

Now it's worse. Much worse.

On April 1, Politico reported that the FBI has upgraded the breach to a "major incident" under the Federal Information Security Modernization Act (FISMA), a 2014 law requiring federal agencies to notify Congress within seven days of determining a breach hits certain thresholds.^[1]

What triggers a FISMA major incident classification? The criteria are blunt:

Exfiltration or compromise of personally identifiable information
Acute risks to national security, foreign relations, public confidence, or civil liberties

Cynthia Kaiser, former deputy assistant director of the FBI's Cyber Division, told reporters: "Thresholds under FISMA are quite high, and only a few agencies declare a major cyber incident every year." She added that she's not aware of the FBI making such a determination on a hack affecting its own networks since at least 2020.^[2]

Read that again. The FBI, the agency responsible for investigating everyone else's breaches, just had to admit its own systems got popped at the highest severity level.

What the Hackers Got

The compromised system contained three categories of data that should make anyone paying attention to the 702 debate deeply uncomfortable:

Pen register and trap/trace data: Logs of every phone number that surveillance targets called and every number that called them. This is the metadata that Section 702 defenders say is "just metadata." Metadata that reveals who talks to whom, when, and how often.
Personal information on investigation subjects: Names, contact details, and identifying data about people the FBI is actively investigating. Blow this cover and you blow ongoing operations.
Legal process returns: Data gathered under court-authorized surveillance orders. The kind of information courts authorized with the explicit understanding it would be protected.

The system was unclassified, but "unclassified" in FBI terms doesn't mean unimportant. This is law enforcement sensitive data that could expose ongoing investigations, compromise confidential informants, and reveal the FBI's surveillance priorities to a hostile foreign intelligence service.

Senator Mark Warner (D-VA) called it "yet another stark reminder that the threat from sophisticated cyber adversaries like China has not gone away."^[3]

Same Playbook, Bigger Target

The attack method should sound familiar. Hackers exploited a commercial internet service provider's vendor infrastructure to access FBI network security controls. The compromised system was reportedly located in FBI offices in the U.S. Virgin Islands, not at headquarters in Washington.^[4]

This is the Salt Typhoon playbook. In 2024-2025, the Chinese hacking group breached nine major U.S. telecoms (AT&T, Verizon, T-Mobile, and others) by targeting the same type of commercial infrastructure that carries wiretap data. They didn't attack the fortress directly. They compromised the supply chain.

Whether this specific breach was Salt Typhoon or a different Chinese group remains under investigation. But the pattern is undeniable: Chinese intelligence services are systematically targeting the infrastructure that carries American surveillance data. They're not stealing credit card numbers. They're mapping who the U.S. government is watching.

First the telecoms. Now the FBI itself.

The 702 Irony Nobody in Congress Wants to Talk About

Section 702 of FISA expires April 20, seventeen days from today. The FBI is lobbying hard for a clean reauthorization, arguing it needs warrantless access to Americans' communications to keep the country safe.^[5]

The argument goes like this: Trust us with this data. We need it. We'll protect it.

Then China walked off with the data.

The timing is brutal for the bureau. Consider the scorecard:

The PCLOB report released April 2 showed FBI warrantless queries dropped from 57,000 in 2023 to 7,400 in 2025, a talking point the FBI uses to argue reforms are working.^[6]
98 Congressional Progressive Caucus Democrats oppose a clean 702 extension, demanding warrant requirements for searches of Americans' data.^[7]
The Government Surveillance Reform Act (Wyden-Lee-Davidson-Lofgren) would require warrants for accessing Americans' communications and close the data broker loophole.^[8]

The FBI's pitch to Congress ("let us keep collecting this data without warrants") now comes with an asterisk: *We might lose it to Chinese hackers.

Every centralized surveillance database is an attack surface. The FBI just proved it with its own systems.

The Surveillance State's Surveillance Problem

Step back and look at the pattern forming:

2024-2025: Salt Typhoon breaches nine telecoms, accesses wiretap infrastructure at AT&T, Verizon, and T-Mobile
February 2026: FBI discovers abnormal activity on its own surveillance network
March 2026: FBI notifies Congress of the breach, U.S. suspects China
April 2026: FBI classifies it as a major incident, the highest severity

Chinese intelligence is working its way up the food chain. Telecoms that carry surveillance data. Then the FBI systems that store it. What's next? The FISA Court itself?

The irony is thick enough to choke on. The U.S. government demands backdoors and warrantless access to communications, arguing that centralized data collection makes the country safer. Meanwhile, that same centralized data becomes the prize target for foreign adversaries.

Senator Ron Wyden has been saying this for years. Every back door built for law enforcement is a back door foreign hackers will eventually find. The FBI just became his best evidence.

What Happens Next

Congressional Response

Will lawmakers demand classified briefings before the 702 vote? This breach makes the "trust the FBI with warrantless access" argument significantly harder to sell.

702 Sunset (April 20)

Seventeen days. Congress has no deal. Progressive Democrats want warrant requirements. The FBI wants a clean extension. This breach gives reformers ammunition.

Vendor Identification

Which commercial ISP vendor was exploited? That company, and the FBI's decision to trust it with sensitive infrastructure, needs scrutiny.

Investigation Fallout

Defendants in FBI cases may challenge evidence gathered through compromised systems. If China knows who the FBI is watching, ongoing operations are blown.

The Bottom Line

The FBI collects enormous quantities of surveillance data on Americans and foreigners. It does so under authorities like Section 702 that assume the data will be protected. That assumption just failed, at the highest severity level, against a threat actor that's been systematically targeting U.S. surveillance infrastructure for over a year.

If the FBI can't protect its own wiretap data from Chinese hackers, the question Congress should be asking isn't "should we renew 702?" It's "should we keep building the databases that adversaries are lining up to steal?"

References

Published: April 3, 2026