On Monday, The Atlantic released an article detailing how its editor-in-chief, Jeffrey Goldberg, had been inadvertently added to a group chat with National Security Adviser Mike Waltz, Vice President JD Vance, and Defense Secretary Pete Hegseth.
The incident, which came shortly before the U.S. attacked Yemen’s Iran-aligned Houthis, reportedly revealed “precise information about weapons packages, targets, and timing” to the journalist.
Just one month prior, the National Security Agency (NSA) warned of the dangers of using the encrypted messaging application Signal before a journalist was added to a high-profile U.S. government group chat disclosing Yemen war plans.
The Guardian reported that on Thursday, March 27, a federal judge ordered that the Trump administration preserve all Signal messages exchanged in the Signal group chat.
James Boasberg, the chief U.S. district judge in Washington, said his order was to ensure no messages from the group chat were lost as all messages were set to delete after a certain time.
The federal judge said his order was not currently due to the Trump administration doing anything wrong.
Boasberg will decide later whether the administration violated federal record laws by using Signal’s disappearing message function.
In February, the NSA sent its employees a bulletin titled “Signal Vulnerability,” claiming the messaging application had been the target of espionage activity.
“A vulnerability has been identified in the Signal Messenger Application. The use of Signal by common targets of surveillance and espionage activity has made the application a high value target to intercept sensitive information,” the bulletin read, viewed by CBS News .
The NSA bulletin warned employees not to send “anything compromising over any social media or Internet-based tool or application.”
Russian hacking groups were also noted as threats to look out for, as the NSA claimed they were deploying phishing scams to access encrypted conversations.
In the same month, the Google Threat Intelligence Group (GTIG) said in a report that multiple Russia-aligned threat actors were observing individuals interested in Signal to gain access to their accounts.
“The most novel and widely used technique underpinning Russian-aligned attempts to compromise Signal accounts is the abuse of the app’s legitimate linked devices feature that enables Signal to be used on multiple devices concurrently,” GTIG said.
Google’s threat teams spotted the attacks, which used QR codes to link victims to a hacked Signal instance.
This allowed the victim’s messages to be delivered to both the victim and the hacker in real-time, allowing bad actors to view all messages being sent and received.
Signal responded to the claims on Tuesday, stating that there was “misinfo flying around that might drive people away from Signal and private communications.”
“The memo used the term ‘vulnerability’ in relation to Signal—but it had nothing to do with Signal’s core tech. It was warning against phishing scams targeting Signal users,” it wrote on X .
“Phishing isn’t new, and it’s not a flaw in our encryption or any of Signal’s underlying technology,” the group added. “Phishing attacks are a constant threat for popular apps and websites.”
On Tuesday, March 25, President Donald Trump played down the incident’s threat to national security and defended the administration’s use of Signal.
“There was no classified information, as I understand it, they used an app if you want to call it an app. That’s an app that a lot of people use,” he told reporters .
The president added that Signal was “the best technology for the moment” and “used by the media a lot.”
Meanwhile, National Security Adviser Mike Waltz has taken full responsibility for the incident, claiming the ordeal was “embarrassing.”
Talking to Fox News on Tuesday, Waltz said: “I take full responsibility. I built the group.”