Dialog Data Leak: Not a Hack, but a Misconfiguration
Dialog, the invite-only group co-founded by Peter Thiel, reported a data breach, but a WIRED investigation found that personal information was publicly accessible due to a website misconfiguration, not a criminal hack.
Dialog, the exclusive group co-founded by Peter Thiel, notified members and past event participants that a database containing their personal information had been breached. However, WIRED's analysis revealed that the files were readable by anyone who visited the group's app landing page — a misconfiguration that cybersecurity experts say effectively made the data publicly accessible.
In an email to affected individuals, Dialog managing director Juliette Levine stated that forensic investigators identified 113 names of past event participants and “some” people registered for this summer's retreat whose information was accessed. Levine alleged the exposure was “a hack executed by a well-known criminal who is wanted in the United States,” and that the group acted out of caution.
Multiple reviews of the site's architecture point to a misconfiguration rather than a break-in. WIRED previously reported that the 113 names include a sitting NATO commander, two US senators, and the US treasury secretary, as well as a longer list of attendees for an August retreat in Ireland. The site, set up to distribute a phone app, allowed anyone to register using any email address without a password. After submitting an email, the visitor's browser loaded internal files on some 200 people, including contact details, login tokens, and internal rankings.
Cybersecurity researcher maia arson crimew, who discovered the exposure, said she neither exploited a flaw nor bypassed security. Experts, including Nicholas Weaver of the International Computer Science Institute, describe it as a web design error. Aaron Mackey of the Electronic Frontier Foundation calls calling it a criminal act “far-fetched,” noting that users simply followed a link on the website.
Dialog sent WIRED a legal demand to hand over the data, characterizing the incident as a “cyberattack,” but WIRED did not comply. Some individuals on the list, including New York Times columnist Ezra Klein, actor Joseph Gordon-Levitt, and actress Sophia Bush, publicly commented on their involvement, emphasizing they do not trust Thiel.
