Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The fake emails sent from an FBI address in November 2021 came through a real FBI-operated server used for Law Enforcement Enterprise Portal (LEEP) notifications. But the FBI said the server was separate from its corporate email service, and that no data or personally identifiable information (PII) on its network was accessed or compromised. The messages’ genuine delivery route did not make their claims genuine.
What happened in the November 2021 incident?
The FBI disclosed the incident on November 13, 2021, and updated its statement on November 14. The bureau said a software misconfiguration had temporarily allowed an actor to use LEEP to send fake emails. LEEP is used to communicate with state and local law-enforcement partners.
The FBI said the emails originated from a server it operated for sending LEEP notifications—not from its corporate email service. In its statement, the agency said no actor accessed or compromised data or PII on its network. It said it took the affected hardware offline, fixed the vulnerability, warned partners to disregard the emails, and confirmed network integrity. Read the FBI’s statement, updated November 14, 2021.
Were the emails really from the FBI?
They were sent through legitimate FBI infrastructure, according to the FBI and contemporaneous reporting, but their alarming content was fake. BleepingComputer reported that the messages used the sender address eims@ic.fbi.gov and a subject line reading “Urgent: Threat actor in systems.” The message purported to be a Department of Homeland Security warning about a sophisticated cyberattack and stolen data. KrebsOnSecurity said the headers on a message it received indicated it came from an FBI server.
#1 Best Overall
This is the key distinction: a real sender system can transmit a fraudulent message if that system is misused. The FBI’s statement specifically distinguished the LEEP notification server from its corporate email service; it did not say that the corporate email service had been hacked. BleepingComputer’s account of the message and KrebsOnSecurity’s reporting describe the contemporaneous evidence.
How was LEEP reportedly misused?
The FBI publicly described the cause as a temporary software misconfiguration, but its cited statement did not provide a technical postmortem. KrebsOnSecurity reported that a person claiming responsibility said the LEEP registration flow generated a one-time passcode on the client side and included it in a POST request with email subject and body parameters. The person claimed to have altered those parameters and scripted repeated messages. This is a reported account by the claimant, not a technical explanation independently published by the FBI.
Krebs reported that the person using the handle Pompompurin claimed responsibility and said the stunt was intended to expose a weakness. The fake message named security researcher Vinny Troia, and coverage discussed a possible effort to discredit him. Those are reported claims and interpretations, not official FBI findings about identity, motive, or affiliation.
How many people received the emails?
BleepingComputer reported a Spamhaus Project estimate that at least 100,000 mailboxes were reached. That was a third-party estimate reported in 2021, not an official FBI count; the cited reporting described it as conservative. The FBI did not publish a campaign reach figure in its statement. See BleepingComputer’s report and attribution for the estimate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Did the FBI lose data, and what did it do?
The FBI said no data or PII on its network was accessed or compromised in this incident. It also said it took the impacted hardware offline quickly, remediated the vulnerability, warned partners to disregard the emails, and confirmed network integrity.
That statement is limited to the FBI network and this incident. It does not establish that recipients faced no risk, that no outside mailbox was affected, or that no later related activity occurred.
Quick Recap
What should you do if an email appears to come from a government address?
- Do not trust the display name or apparent sender address by itself.
- Avoid opening unexpected attachments or following links, even when a message appears to use a government address.
- Verify consequential requests through an official phone number or website you find independently, rather than contact details or links in the message.
- Report suspected email fraud through appropriate official channels. The FBI’s general Business Email Compromise guidance advises checking the email address, URL, and spelling, and reporting suspected BEC to IC3. This is general email-fraud guidance, not a special instruction issued for recipients of the 2021 LEEP messages.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
