TL;DR: On February 17, 2026, the FBI discovered that hackers (suspected to be China's Salt Typhoon group) had broken into DCS-3000 ("Red Hook"), the unclassified system the bureau uses to manage court-authorized wiretaps. The breach exposed phone numbers of active surveillance targets, pen register metadata revealing who the FBI was monitoring, and personally identifiable information on investigation subjects. The Department of Justice classified it as a "major incident" under FISMA and notified Congress on March 4. The attackers got in through a commercial ISP vendor's infrastructure: the same supply-chain playbook Salt Typhoon used to penetrate AT&T, Verizon, and six other telecoms in 2024. If you're wondering why this matters: a foreign intelligence service now has a roadmap of who American law enforcement is watching.
The FBI's Own Surveillance System Got Surveilled
On February 17, 2026, FBI analysts flagged abnormal log activity on the bureau's Digital Collection System Network, specifically on DCS-3000, internally known as "Red Hook."[1]
DCS-3000 is the FBI's backend for managing pen register and trap-and-trace surveillance. When a federal judge authorizes the FBI to monitor who a suspect is calling, texting, or emailing (without listening to the actual conversations) it goes through DCS-3000. The system tracks phone numbers dialed, call timing, routing data, and IP addresses of websites visited.[2]
Someone who shouldn't have been there had been inside this system. And they'd been reading.
On March 4, the FBI first alerted Congress that it had detected "suspicious activity on an internal system storing law enforcement sensitive information." By March 23, the Department of Justice concluded that the breach qualified as a "major incident" under the Federal Information Security Modernization Act, a designation reserved for breaches causing "demonstrable harm" to national security.[3]
What the Hackers Got
The compromised system contained:[1][4]
- Phone numbers of active surveillance targets: the single most dangerous piece of data in this breach
- Pen register and trap-and-trace metadata: records showing who the FBI was monitoring, when, and through which communications channels
- Personally identifiable information tied to subjects of FBI investigations
- Information revealing active criminal probes and the scope of ongoing surveillance operations
Let that sink in. Pen register data doesn't capture what people say. But it tells you exactly who's being watched. As one security expert told Nextgov: "It can give them a heads up of who they need to cut ties with, or bring back, or if their asset is compromised."[1]
If you're a foreign intelligence service, this is gold. You now know which of your assets are burned. Which of your operations are under FBI scrutiny. Which phone numbers to stop using and which contacts to sever, or feed disinformation through.
The ISP Vendor Backdoor
The FBI told Congress that the attackers gained access by "leveraging a commercial Internet Service Provider's vendor infrastructure," which the bureau described as reflecting the group's "sophisticated tactics."[3]
Translation: the hackers didn't attack the FBI directly. They compromised a commercial ISP that connects to the FBI's network. From there, they pivoted into DCS-3000.
This is the same playbook that worked spectacularly in 2024. The same ISP vendor attack path. The same target: America's wiretap infrastructure.
Michael Bell, founder and CEO of Suzu Labs, put it bluntly: "The attackers got in through a vendor ISP that connects to the FBI's network, not through the FBI's own defenses."[4]
Salt Typhoon: Back for Round Two
Investigators have focused on Salt Typhoon, a threat actor linked to China's Ministry of State Security.[2]
If the name rings a bell, it should. Between 2019 and 2024, Salt Typhoon ran one of the most damaging espionage operations in recent American history:
- Breached eight domestic telecom and internet service providers, including AT&T, Verizon, and T-Mobile
- Siphoned call records from tens of millions of Americans
- Accessed FBI wiretap infrastructure through those same telecom providers
- Compromised communications of both major parties' presidential campaigns during the 2024 election
The 2024 telecom breach was, by many accounts, the worst intelligence failure against the American telecommunications system in history. FBI Director Christopher Wray called it "the most significant cyber espionage campaign against the U.S. in years."[5]
Two years later, the same group (or one using identical tactics) walked into a different door and found the same kind of data. The FBI's own surveillance metadata.
March 2026: A Terrible Month for FBI Cybersecurity
The DCS-3000 breach wasn't the only incident. Security Magazine reported that the FBI experienced multiple cyber incidents in March 2026:[4]
- The DCSNet/DCS-3000 surveillance system breach (discovered February 17)
- A compromise of FBI Director Kash Patel's email, claimed by Iran's Handala Hack Team
- Additional internal system intrusions
The cascade of breaches prompted involvement from the White House, DHS, and NSA.[4]
Senator Mark Warner (D-VA), vice chair of the Senate Intelligence Committee, warned: "Our adversaries are probing for weaknesses, and they're finding them." Warner specifically cited concerns about cybersecurity staff reductions across federal agencies leaving systems vulnerable.[3]
Why This Is Different From a Normal Breach
When a retailer gets breached, you worry about credit card numbers. When a health insurer gets breached, you worry about medical records. When the FBI's surveillance system gets breached, the damage is strategic.
Foreign intelligence services don't want your Social Security number. They want to know:
- Which of their spies are being watched
- Which criminal organizations the FBI is monitoring (and which it isn't)
- Which investigations are active and how far they've progressed
- Which phone numbers and communication channels are compromised
This data lets an adversary reroute intelligence operations, burn compromised assets before they can be arrested, and identify gaps in FBI coverage. It's a counterintelligence nightmare.
And the attack vector, a commercial ISP vendor, means the FBI can't fix this alone. The bureau's security is only as strong as the weakest link in every vendor that touches its network.
The Vendor Supply Chain Problem Won't Go Away
Matt Wyckhouse, CEO of Finite State, highlighted the structural issue: "Product security is now a national security issue." He noted the U.S. lacks consistent baselines for supply chain security compared to Europe's emerging standards.[4]
This is the same problem we keep seeing across the private sector. ShinyHunters breaching companies through SaaS vendors. Adobe getting hit through a BPO contractor. And now Chinese intelligence breaching the FBI through a commercial ISP.
The pattern is identical: don't attack the target. Attack the vendor who has access to the target. We break down the broader trend in our guide to supply chain attacks in 2026.
Until the U.S. government mandates security baselines for every vendor that touches federal law enforcement infrastructure (not just the classified systems, but the unclassified ones too) this will keep happening.
What This Means for You
If you're a regular citizen, the direct risk is low. Your personal data wasn't in this system (unless you're under FBI investigation).
But the indirect consequences matter:
- Active FBI investigations may be compromised. Criminal cases, counterterrorism operations, and intelligence gathering could all be affected if targets learn they're being monitored.
- The FISA Section 702 debate gets more complicated. Congress is three days from the Section 702 expiration deadline. A breach of the FBI's surveillance infrastructure doesn't exactly inspire confidence in giving the bureau more surveillance authority.
- Supply chain security is a national security issue. If the FBI can't secure its vendor relationships, neither can your bank, your hospital, or your employer. Demand better from the institutions that hold your data.
The Uncomfortable Truth
The FBI builds some of the most sophisticated surveillance tools on the planet. It can monitor phone calls, track internet activity, and coordinate wiretaps across every jurisdiction in the country. But it stores that surveillance data on a system that got breached through a commercial ISP.
The agency that watches everyone couldn't stop someone from watching it.
China's intelligence services, whether Salt Typhoon or a group using the same playbook, now have a window into who America's premier law enforcement agency was surveilling. They know which phone numbers mattered. Which investigations were active. Which targets were hot.
And the same ISP vendor supply chain that let them in two years ago let them in again.
Sources
- Nextgov/FCW: "Suspected Chinese breach of FBI system exposed surveillance targets' phone numbers" (April 2026)
- NBC News: "FBI labels suspected China hack of law enforcement data 'a major cyber incident'" (April 2026)
- The Hill: "FBI labels data breach 'major incident,' notifies Congress" (April 2026)
- Security Magazine: "Breach of FBI Surveillance System Considered a 'Major Incident,' Security Experts Weigh In" (April 2026)
- CyberScoop: "FBI: Threats from Salt Typhoon are 'still very much ongoing'" (2026)