China-linked hackers breached the FBI's own wiretap system and exposed the phone numbers of active surveillance targets

China Hacked the FBI's Wiretap System. The Targets Found Out the Wrong Way.

The FBI's DCSNet platform — known internally as DCS-3000 — is the system federal agents use to intercept phone calls under court-authorized wiretaps. It is, by definition, one of the most sensitive law enforcement databases in the United States. In April 2026, Nextgov confirmed it had been compromised.

Salt Typhoon

The intrusion was attributed to Salt Typhoon, a threat actor linked to Chinese state intelligence. The group had previously been connected to breaches of major U.S. telecommunications carriers. The DCSNet compromise was different: this was not a carrier. This was the FBI's own surveillance infrastructure.

What Was Exposed

The breach exposed the phone numbers of individuals under active FBI surveillance. That means the targets of ongoing federal investigations — people whose calls were being legally intercepted — had their identities and contact information handed to a foreign intelligence service. The FBI declared a major cyber incident under the Federal Information Security Modernization Act.

The Irony on Record

The United States government built a mandatory wiretap access system — CALEA — requiring telecommunications companies to build intercept capabilities into their networks. Security researchers spent decades warning that mandatory backdoors create vulnerabilities. The DCSNet breach is not a hypothetical. It is the outcome those researchers predicted.