We have to talk about Pete Hegseth some more.
In a troubling development for United States Secretary of Defense Pete Hegseth, new reports reveal that he used an unsecured internet connection to install the messaging application Signal on Pentagon devices. This action raises significant security concerns, particularly given that Hegseth’s personal phone number was also easily accessible online, potentially exposing him to espionage threats. According to a report by The Washington Post, Hegseth installed Signal on a desktop computer to circumvent poor cell service at the Pentagon, despite the military’s ban on personal devices in classified spaces. This on top of the fact Hegseth reportedly shared sensitive information through Signal, including military plans, prompting investigations into his digital practices. The use of Signal, which automatically deletes messages after thirty days, may also put Hegseth and federal agencies in violation of the Federal Records Act, raising alarms about the preservation of government records.
The Pentagon Inspector General is expanding its inquiry into Secretary Hegseth, to include a second chat that may have involved the transfer of classified information from a secure government computer to Hegseth’s personal devices. According to reports from The Wall Street Journal, the inquiry is focusing on how classified data was shared shortly after being sent from government systems. Hegseth, who previously downplayed the significance of the first chat linked to discussions about military action in Yemen, has remained silent on the details of the second chat, which included family and friends.
Michael Waltz, recently removed as national security adviser, was photographed using a modified version of the Signal messaging app during a Cabinet meeting. The app, known as “TM SGNL,” is designed to archive messages to comply with presidential record-keeping requirements, which some officials have criticized for potentially compromising national security. During the Cabinet meeting, visible messages on Waltz’s phone indicated communications with notable officials, including Secretary of State Marco Rubio and Vice President JD Vance.
And that app? A recent security breach has exposed customer data from TeleMessage, a company that provides modified messaging apps, including a clone of Signal, to the U.S. government for archiving communications. The hacker accessed sensitive information, including direct messages and group chats from high-ranking officials, highlighting vulnerabilities in the app’s security measures. The breach raises concerns about the encryption protocols used by TeleMessage, as archived chats were not end-to-end encrypted, allowing unauthorized access. The leaked data includes information related to Customs and Border Protection and major financial institutions like Coinbase. Telemessage has suspended operations.
Why do we care?
The unfolding scandal involving Secretary of Defense Pete Hegseth and the broader misuse of Signal and its derivatives within high-level government communications is not just a national security embarrassment—it’s a glaring example of cybersecurity governance failure at the highest levels. And it has ripple effects that directly undermine efforts by IT service providers to drive cybersecurity accountability in the private sector.
When the Secretary of Defense bypasses secure channels to install a private messaging app on Pentagon systems, it sends a dangerous message: cybersecurity is optional, even in the most sensitive environments. This makes it harder for IT services firms to push clients—especially SMBs—to take policy enforcement and compliance seriously. If the Pentagon can’t follow its own rules, why should anyone else?
TeleMessage was designed to bridge the gap—Signal-style messaging with record compliance. But the breach shows that modifying secure apps for policy needs can introduce new vulnerabilities, especially when encryption is weakened. IT leaders should take note: “compliant” doesn’t mean “secure” unless proven through transparent testing and oversight.
The Hegseth saga isn’t just a security lapse—it’s a systemic governance failure that puts U.S. cybersecurity credibility at risk. For IT services firms, this is both a warning and an opportunity:
- Double down on executive accountability.
- Sell governance as strategic risk mitigation—not just compliance.
- Reinforce that tech choices without policy backing create more exposure, not less.