FBI China-Linked Hackers Breach Wiretap Surveillance System in 'Major Incident'

On February 17, 2026, FBI analysts flagged abnormal log activity on the bureau's Digital Collection System Network (DSCNet), specifically the DCS-3000 component known internally as Red Hook. This unclassified system processes pen register and trap-and-trace surveillance data - court-authorized metadata collection that logs phone numbers dialed from and received by surveillance targets, along with websites visited by internet-connected devices.

The system does not capture the content of communications, but the metadata it holds reveals who the FBI is watching, when they are being watched, and who they are communicating with.

The FBI first notified Congress on March 4, 2026, that it had detected suspicious activity on an internal system storing "law enforcement sensitive information," but did not name a suspect at that time. " Investigators subsequently determined that the threat actor had exploited a commercial Internet Service Provider's vendor infrastructure to gain access - a supply chain attack that bypassed FBI's direct network perimeter defenses. The affected systems were located in the U.S. Virgin Islands, not at FBI headquarters in Washington.

" The DOJ formally notified Congress of this classification, triggering the mandatory seven-day reporting window. " Bloomberg reported that the breach prompted both a criminal investigation and a broader cybersecurity review of the bureau's networks.

The Wall Street Journal first reported the suspected Chinese nexus to the hack on March 6. Politico subsequently reported on April 1 that the FBI had formally declared the intrusion a "major cyber incident," with additional reporting from NBC News, Fox News, Bloomberg, and Nextgov/FCW filling in details about the scope and counterintelligence implications of the breach. The FBI has declined to comment beyond its initial acknowledgment.

U.S. investigators suspect hackers affiliated with the Chinese government are responsible for the breach. Investigators have focused attention on Salt Typhoon, a PRC state-sponsored threat actor linked to China's Ministry of State Security (MSS) that has been active since at least 2019. The group is tracked across the threat intelligence community under multiple designations: Earth Estries (Trend Micro), GhostEmperor (Kaspersky), FamousSparrow (ESET), RedMike (Recorded Future), UNC2286 (Mandiant), and OPERATOR PANDA (CrowdStrike).

Salt Typhoon's operational profile aligns with the FBI breach in several respects. The group previously compromised at least nine major U.S. telecommunications providers - including AT&T, Verizon, T-Mobile, Lumen Technologies, Charter Communications, Consolidated Communications, and Windstream - between 2019 and 2024, gaining access to CALEA (Communications Assistance for Law Enforcement Act) lawful intercept systems used by law enforcement.

In that campaign, Salt Typhoon intercepted call recordings of senior U.S. politicians and obtained "virtually complete lists of all FBI wiretap targets," according to reporting by NBC News. By August 2025, the FBI acknowledged Salt Typhoon had compromised at least 200 organizations across more than 80 countries.

However, no formal technical attribution has been issued by the FBI linking Salt Typhoon - or any specific Chinese threat group - to this breach. The attack vector (exploitation of ISP vendor infrastructure) is consistent with Salt Typhoon's documented tradecraft of targeting telecommunications supply chains, but multiple PRC-affiliated groups operate with similar capabilities. China has denied responsibility for Salt Typhoon operations and all related intrusions.

• Phone numbers of active FBI surveillance targets - revealing who the bureau is monitoring in real time
• Pen register returns - outgoing call metadata including numbers dialed from targets' phone lines, with date and time stamps
• Trap-and-trace returns - incoming call metadata including numbers calling targets' phone lines
• Website visit logs from internet-connected devices under surveillance
• Personally identifiable information (PII) on subjects of active FBI investigations - names and identifying details tied to surveillance warrants
• Source and destination IP addresses associated with monitored communications
• Metadata revealing communication patterns, frequency, and timing of contacts between surveillance targets and their associates
• Surveillance operational data - which individuals are under active FBI monitoring, the scope of collection, and the legal authorities (pen register orders, FISA warrants) used to authorize surveillance The counterintelligence significance of this exposure cannot be overstated. As John Fokker, head of threat intelligence at Trellix and former official in the Dutch National Police's High-Tech Crime Unit, stated: the compromised data "can give them a heads up of who they need to cut ties with, or bring back, or if their asset is compromised." If Chinese intelligence services accessed this data, they could identify which of their own operatives the FBI was monitoring - and take immediate steps to burn assets, sever communication chains, or extract compromised officers.