Dialog, the invite-only network cofounded by billionaire investor Peter Thiel, has told members and past event participants that a database containing their personal information was breached by a criminal hacker. A technical review of the group’s digital infrastructure, however, indicates no intrusion occurred. Instead, the data was left exposed on a publicly accessible landing page due to a straightforward cloud misconfiguration, allowing anyone with a browser to retrieve it without authentication.
The notification, sent by Dialog managing director Juliette Levine and reviewed by WIRED, stated that forensic investigators determined that the names of 113 past Dialog event participants had been exposed, alongside data for an unspecified number of people registered for the group’s upcoming summer retreat near Dublin, Ireland. Levine described the incident as “a hack executed by a well-known criminal who is wanted in the United States,” adding that Dialog had acted “out of caution” to protect “the safety, privacy, and reputation of every Dialoger past and present.” Multiple independent reviews of the site’s publicly accessible architecture contradict that characterization, pointing to a configuration failure rather than a break-in.
How the Dialog Data Exposure Occurred
A Dialog-operated website, designed to distribute a mobile application for the August gathering, allowed any visitor to register using any email address without requiring a password. After submitting an email, the user landed on a near-empty holding page. Critically, the same page loaded internal files on approximately 200 individuals directly into the visitor’s browser. Viewing those files required no special tools beyond the built-in inspector functions available in every major internet browser—essentially, the data was served to anyone who visited the page and looked at its underlying code.
Cybersecurity experts classify this type of vulnerability as a misconfiguration, not a hack. No system breach, password cracking, or exploit was needed. The data was simply left accessible on the public internet.
What Data Was Exposed and Who Was Affected
The records made accessible through this misconfiguration include senior figures in national security, intelligence, and technology, both current and former. The 113 names Dialog confirmed as past event participants include a sitting NATO commander, two US senators, the US treasury secretary, and other high-profile individuals. A separate, longer list revealed those registered for the August retreat, among them NATO officials, a current White House intelligence official, a retired general who held a senior US intelligence role, and the heads of national security policy and partnerships at two leading AI firms. Other individuals identified include a former British security minister, a former Japanese defense minister, and a former Pakistani diplomat.
For nearly all of these individuals, the exposed data was comprehensive: private contact information, active login tokens, dates of birth, emergency contacts, cell phone numbers, political leanings assigned by Dialog, internal rankings and grading notes, and the digital keys serving as member logins. Much of this data originated from Dialog’s Airtable databases, accessed via completed forms hosted by the service Fillout.
Fillout stated to WIRED that it was “not aware of any compromise of Fillout systems or active platform vulnerability,” noting that its customers configure their own forms, connected data sources, and workflows, and that “the behavior of a given form depends on that configuration.” Fillout declined to comment on any specific customer’s forms or records. Airtable did not respond to requests for comment.
Why Labeling This a Hack Matters
The classification of this incident has practical consequences for affected individuals and for Dialog itself. Describing a misconfiguration as a hack can obscure the root cause, leading organizations to invest in perimeter defenses while leaving the actual vulnerability—insecure cloud storage or application logic—unaddressed. It also shifts the narrative from negligence to criminal targeting, a distinction that carries legal and reputational weight. For the 113 past participants and the roughly 200 registered attendees whose data was exposed, the practical effect is the same regardless of how it happened: their personal information was available to anyone who found the landing page.
What Affected Individuals Should Do Now
Anyone who has participated in a Dialog event or registered for the August retreat should assume that their personal data, including contact details and login credentials, has been exposed. The following steps are recommended: change passwords for any accounts that use the same credentials as Dialog’s systems, enable two-factor authentication on all accounts that support it, monitor financial accounts and email for phishing attempts or unauthorized activity, and be cautious of unsolicited communications that reference Dialog or its events. Using a reputable VPN with a verified no-logs policy when accessing sensitive accounts over public Wi-Fi adds an additional layer of protection. Those affected should also consider placing a fraud alert on their credit file if Social Security numbers or other government identifiers were included in the exposed records.
