IC Oversight & Policy — 2026-07-04

Unknown Party Seized The Intercept Signal Tip Line and Solicited Whistleblowers for Months

BLUFSilent remediation without source notification transforms a security breach into an ongoing counterintelligence risk for every whistleblower who used that channel since February.

An unidentified party seized control of The Intercept's Signal tip line by exploiting a dormant username that Signal had recycled, then used it since at least February to solicit whistleblower tips through a fraudulent X account posing as "Investigative Intake," according to Drop Site News 1. The X account made roughly 100 posts between February and May and, when contacted by a Drop Site reporter on July 1, replied soliciting information; the account listed a Hong Kong location and Japan App Store origin, though location data can be manipulated with VPNs 1. The Intercept switched to a new Signal account on June 30, describing the change publicly only as following "security best practices" without disclosing the breach 1. The outlet's chief legal officer did not answer questions on how the account was seized, how long the compromise lasted, or whether affected sources were notified, and told Drop Site "we have received no information that any source was compromised" 1.

Analysis
An unidentified party controlled the Intercept's most sensitive intake channel for at least four months, leaving any source who used the line before June 30 unable to confirm their identity was not exposed to an unvetted third party. The silent switch, framed only as routine security hygiene, denied prior sources the chance to assess exposure or take protective steps, and the fraudulent account's continued activity past disclosure suggests the intrusion remains unresolved rather than closed. No source was actually compromised is also possible, since the scheme solicited tips publicly rather than mining the line's private message history. Reporting rests solely on Drop Site News, staffed by former Intercept journalists with the underlying documentation. Newsrooms leaning on Signal tip lines face a structural weakness: recyclable dormant usernames outpace current disclosure practices.

2 sources

A Third Party Breached The Intercept Signal Tip Line and Has Been Soliciting Whistleblowers - Drop Site News
The Intercept Frames Signal Tip Line Breach as a Best Practice - flyingpenguin