Fact Checking Claims that Hegseth's Signal Chat Phone Number Was Found on Russian Spies' Devices

A Deeper Look at claims circulating on the internet

Author’s Note: I woke up to a flurry of emails asking about these reports so I have taken a “Deeper Look” at them.

Overview of the Claim

Over the last 24 hours social media platforms have been buzzing with claims that U.S. Secretary of Defense Pete Hegseth's private phone number was discovered on the mobile devices of two individuals arrested in Germany on espionage charges. The claims have been propagated by various accounts, including @YourAnonCentral on X (formerly Twitter) and a Facebook group titled "Liz Cheney/Adam Kinzinger Against Trump” — a group that supports Kinzinger/Cheney but is not officially affiliated with either Cheney or Kinzinger.​

Context: Hegseth's Communication Practices

This comes as Hegseth is embroiled in “Signalgate” for his use of “Signal” for private chats in which he disclosed classified information. Expanding from the Signal chat issue, investigations by outlets including Der Spiegal and The Guardian have confirmed that Hegseth's personal phone number was widely accessible online due to leaks from platforms like WhatsApp, Airbnb, and Facebook. This exposure has raised legitimate concerns about information security at the highest levels of government.​ (See our report: There’s More to Signalgate Than the Two Chats We Know About.)

The Arrests in Germany — Details Matter

The claims point to the following: On April 18, 2024, German authorities arrested two individuals, identified as Dieter S. and Alexander J., in the Bavarian town of Bayreuth. Both are dual German-Russian nationals. According to the German Federal Prosecutor's Office, the suspects were accused of spying for Russia and plotting sabotage attacks on military infrastructure, including U.S. military facilities in Germany. Specifically, they allegedly scouted targets such as the U.S. Army's Grafenwöhr Training Area in Bavaria, a key site for training Ukrainian troops. The suspects reportedly took photographs and videos of military transports and goods, intending to disrupt NATO logistical support to Ukraine. ​

Assessing the Credibility of the Phone Number Claim

Despite the widespread dissemination of the claim that Hegseth's phone number was found on the suspects' devices, I have been able to find no corroboration from official government sources, reputable news organizations, or from any unofficial but well-connected intelligence sources. Major outlets such as CBS News, Reuters, and The Guardian have reported extensively on the arrests and the suspects' alleged activities but have not mentioned any discovery of Hegseth's contact information on their devices.​ This seems to be an entirely “social media generated” bit of information.

MS COMMENT: The nature of the suspects' alleged activities—scouting physical locations and gathering visual intelligence of potential sabotage targets— would seem to put these two in the bucket of ‘low-level support agents.’ It seems unlikely (though certainly not impossible) that low-level operatives doing casing activities would simultaneously be involved in high-level technical collection efforts against the US Secretary of Defense. In other words, ground-level reconnaissance actors seem unlikely candidates to also be doing high-level espionage involving direct communication among U.S. government personnel.​

Related Matter: Investigating the "phegseth.ru" Email Claim

A related claim circulating online suggests that an email address "phegseth.ru" was identified and belonged to Hegseth. The claim appears to have originated with Pekka Kallioniemi, whom the International Centre for Defence and Security in Estonia credits as an expert on social media and disinformation. Kallioniemi posted:

Another X post claimed that the email address password matched the password used by Hegseth on his Princeton.edu account.

Eventually, however, another Russian user “Timofey V” posted and documented that he had checked the email address with the provider, found it to be available (hence not previously registered) and had just that day registered the email address phegseth@mail.ru — proviing, it seems, that the email address did not exist previously.

The Bottom Line

Hegseth has committed egregious security violations by disclosing highly classified into in Signal chats. These alone should get him removed from his position, so in no way am I giving him a pass. But these latest allegations as juicy as they are, are not confirmed and in my estimation are not likely to turn out to be true. They go in the “internet rumor” bucket. If indeed, actual evidence surfaces that the arrested spies did have Hegseth’s phone number, or that the phegseth@mail.ru email address actually existed and was resgistered to Hegseth — I’ll be ready to report it. But for now this goes into the “internet rumor” bucket, or worse.