Messaging app used by Trump official suspends operations after reported hack

An encrypted messaging app that President Donald Trump’s then-national security advisor Mike Waltz used during a Cabinet meeting last week has temporarily suspended service after it was reportedly hacked.

The hacker of TeleMessage, an Israel-founded app that acts as a modified version of Signal, has not obtained the messages of Waltz or the people he spoke to, according to 404 Media, which first reported the cyberattack Sunday.

But the reported breach nevertheless raises questions about whether the app that lets clients archive messages for compliance purposes, which top government officials appear to be using, is secure.

“TeleMessage is investigating a potential security incident,” a spokesperson for Smarsh, which runs the app, told CNBC in a statement. “Upon detection, we acted quickly to contain it and engaged an external cybersecurity firm to support our investigation.”

“Out of an abundance of caution, all TeleMessage services have been temporarily suspended,” the spokesperson said. “All other Smarsh products and services remain fully operational.”

Data stolen by the hacker includes the contents of messages sent using TeleMessage’s versions of Signal, WhatsApp, Telegram and WeChat, 404 Media reported.

Smarsh in March announced the launch of a Public Sector Division that aims “to address the escalating need for secure, compliant communication solutions among government agencies.”

“This breach is alarming on many levels,” said Thomas Richards, infrastructure security practice director at Black Duck, a Massachusetts-based app security company, in a statement to CNBC.

“Taking a secure messaging application and changing a core functionality such as backing up messages essentially breaks the security model,” Richards said. “This creates a security risk for users of the application as their sensitive information could be, and has been, compromised.”

The White House did not immediately respond to CNBC’s request for comment on the temporary suspension of TeleMessage services. It has defended the use of Signal within the administration, saying the app is approved for official use and comes loaded onto government phones.

But Trump had previously discouraged officials in his administration from using Signal in the wake of the leak controversy dubbed “Signalgate,” when Waltz accidentally added a journalist to a private discussion of pending military plans.

“I think we learned: Maybe don’t use Signal, okay?” Trump said in an interview with The Atlantic last month.

Trump’s comments were published two days before Wednesday’s Cabinet meeting, when Waltz was photographed with TeleMessage open on his phone.

The photo taken of Waltz indicated he was communicating with Vice President JD Vance, Secretary of State Marco Rubio, director of national intelligence Tulsi Gabbard and special envoy Steve Witkoff.

Part of the Signalgate controversy involved questions about whether the messages in that private thread were being automatically erased, potentially implicating federal records-retention laws.

TeleMessage markets itself as a way for government agencies and businesses to adhere to those laws by making backup copies of chats.

But 404 Media reported last week that TeleMessage could undermine Signal’s end-to-end encryption — which protects the privacy of messages — because “the messages can be later retrieved after being stored somewhere else.”

A Signal spokesperson told NBC News on Friday, “We cannot guarantee the privacy or security properties of unofficial versions of Signal.”

One day after the Cabinet meeting, Trump announced he will nominate Waltz to be the U.S. ambassador to the United Nations.

Rubio, who already serves as secretary of state, acting administrator of the U.S. Agency for International Development and acting archivist of the United States, will serve as interim national security advisor until the post is filled, Trump said.