A Third Party Breached The Intercept’s Signal Tip Line and Has Been Soliciting Whistleblowers

The news outlet changed its tip line this week, but has not informed potential sources or the public of the breach.

The Signal app. Photo by Jaap Arriens/NurPhoto via Getty Images.

The tip line for the news outlet The Intercept was taken over by an unknown actor purporting to work for the publication—an extraordinary breach of operational security that put prospective whistleblowers at significant risk. The third party with control of the tip line on the encrypted messaging app Signal has been communicating with prospective sources; at least one fraudulent social media account has been soliciting tips since February.

After becoming aware of the breach, The Intercept switched to a new Signal account, according to a June 30 social media post. “In keeping with security best practices, we have updated our Signal tip line,” The Intercept posted across platforms. “If you want to contact The Intercept, please get in touch with our reporters individually or use the Signal account Theintercept_tips.01.”

The post concluded, “Please do not use the username TheIntercept.01.” No further information, beyond the suggestion that the update was related to routine “security best practices,” was included.

That account had until recently been listed on the website as an official and secure Signal tip line. The same message is now listed on the company’s page providing instructions to whistleblowers, but there is no indication for prospective sources that their information may have been compromised if they communicated with the previous Signal account.

Screenshot from The Intercept’s “Become a Source” page.

David Bralow, The Intercept’s chief legal officer, responded to a request for comment but did not directly address questions about how the tip line was seized, how long the situation persisted, how it was discovered, or whether any steps had been taken to inform prospective sources that their information and identity may have been compromised.

“After learning about an effort to impersonate The Intercept on social media and claiming our Signal tips account, The Intercept set up a new Signal username,” Bralow said in a statement. “We directed people to use only this newly established Signal account. We broadly disseminated that message both on our website, on social media, and in our newsletter. We have taken action to try to get the social media account removed.”

It is not clear exactly when The Intercept lost control of its Signal tip line, which is intended to protect anonymous sources seeking to leak information to the outlet confidentially. But since at least February of this year an X account describing itself as “Investigative Intake” for the publication has been active online soliciting tips and responding to posts from U.S. lawmakers and administration officials, making roughly 100 such posts between February and May.

A Drop Site reporter reached out to the X account, whose bio still points people to the breached tip line, on July 1 and received a reply soliciting information. A message sent to the breached Signal account was delivered, indicating it remains active, but did not receive a response.

The X account still posing as “investigative intake” for The Intercept on July 2, 2026.

“We have received no information that any source was compromised,” The Intercept’s counsel told Drop Site. The X account was still posing as The Intercept on July 2, and responding to potential sources. Drop Site reviewed information demonstrating that the seized Signal account was used by the third party.

Signal user IDs associated with accounts that are left dormant are eventually recycled and made available to new users. The individual or organization who took control of the Signal tips line for confidential sources may have been able to take over after the ID went dormant, despite still being listed on the organization website, and began soliciting tips posing as The Intercept.

The X account is still active and responding to direct messages. A person using the account claimed they worked on the “investigative intake side” of The Intercept and would be “happy to take tips directly.”

The X account was opened in February 2026, indicating a location of Hong Kong, and connection to the platform via the Japan App Store, though location data is easily manipulated using VPNs.

Drop Site News was founded by veterans of The Intercept and received a limited, one-time start-up grant from the organization. No editorial relationship exists between the two. In February 2024, as Semafor has previously reported, The Intercept fired its editor in chief, Roger Hodge, laid off several staff, and moved its editorial operations under the supervision of the organization’s business side. The deputy editor, Nausicaa Renner, resigned in protest, and The Intercept brought in a new EIC, Ben Muessig, who was made to report to CEO Annie Chabel. Intercept co-founder Jeremy Scahill and DC Bureau Chief Ryan Grim urged The Intercept’s board to resign and restore editorial independence; the proposal was rejected, and Scahill, Grim, and Renner subsequently founded Drop Site News, soon joined by Murtaza Hussain, Casey Quirke, and, later, by Hodge.

The Intercept offers regular security and information privacy trainings for journalists—including hosting a live event Thursday on securing personal data for journalists: “Participants will learn how to find and remove personal information, strengthen their digital security,” and, the event description notes, “respond effectively before, during, and after an online attack.”

Thursday’s invitation for The Intercept’s virtual training on protecting personal data.

If you communicated with The Intercept’s Signal tip line and suspect you may have sent information to the third party, please get in touch with Murtaza Hussain on Signal at mmkh.56.