Signal Clone Used by Mike Waltz Pauses Service After Reports It Got Hacked

WIRED

05-05-2025

May 5, 2025 5:24 PM The communications app TeleMessage, which was spotted on former US national security adviser Mike Waltz's phone, has suspended 'all services' as it investigates reports of at least one breach. US National Security Adviser Mike Waltz checks his mobile phone while attending a cabinet meeting at the White House on April 30, 2025. Photograph: Evelyn Hockstein/Reuters
The messaging app used by at least one top Trump administration official has suspended its services following reports of hackers stealing data from the app. The company, TeleMessage, says it is now investigating the incident.
'TeleMessage is investigating a potential security incident. Upon detection, we acted quickly to contain it and engaged an external cybersecurity firm to support our investigation,' a Smarsh spokesperson tells WIRED in a statement. 'Out of an abundance of caution, all TeleMessage services have been temporarily suspended. All other Smarsh products and services remain fully operational.'
President Donald Trump's now-former national security adviser Mike Waltz was captured by a Reuters photographer last week using an unauthorized version of the secure communication app Signal—known as TeleMessage Signal or TM Signal—which allows users to archive their communications. Photos of Waltz using the app appear to show that he was communicating with other high-ranking officials, including Vice President JD Vance, US Director of National Intelligence Tulsi Gabbard, and US Secretary of State Marco Rubio.
Experts told WIRED on Friday that, by definition, TM Signal's archiving feature undermined the end-to-end encryption that makes the actual Signal communication app secure and private. 404 Media and independent journalist Micah Lee reported on Sunday that the app had been breached by a hacker. NBC News reported on Monday that it had reviewed evidence of an additional breach.
TeleMessage was founded in Israel in 1999 and was acquired last year by the US-based digital communications archiving company Smarsh. TeleMessage makes apparently unauthorized versions of popular communications apps that include archiving features for institutional compliance. But the company claims that its lookalikes have the same digital defenses as their legitimate counterparts, potentially giving users a false sense of security.
Waltz's app usage came under intense scrutiny last month after he appeared to have added the editor-in-chief of The Atlantic to a Signal group chat in which Trump administration officials discussed plans for a military operation. Dubbed SignalGate, the scandal ultimately preceded Waltz's ouster as national security adviser. President Trump said last week that he plans to nominate him to be ambassador to the United Nations.
TeleMessage apps are not approved for use under the US government's Federal Risk and Authorization Management Program, or FedRAMP, and yet they seem to be proliferating. Leaked data reportedly from TM Signal indicates that multiple US Customs and Border Protection agents may be using the Signal lookalike. When asked about the breach and whether CBP officers use TM Signal, the agency tells WIRED, 'We're looking into this.'
After a number of reports by Lee and 404 Media over the weekend, TeleMessage removed all content from its website on Saturday and took down their archiving service on Sunday.
'We are committed to transparency and will share updates as we are able,' the Smarsh statement adds. 'We thank our customers and partners for their trust and patience during this time.'
Since the revelation last week that Mike Waltz appeared to be using TM Signal, experts have feared that information shared on the app could jeopardize US national security.