Back in February 2023, someone not on the FBI payroll managed to get into a server at the bureau's New York field office and look through files tied to the investigation of Jeffrey Epstein. New details from recently released justice department documents, plus people familiar with the matter, show the intruder was likely a foreign cybercriminal who did not realize they had broken into a law enforcement system.

FBI reaction in plain English

The bureau calls the event a cyber incident and says it was an isolated case. Agency staff restricted the intruder's access and fixed the network configuration. The internal investigation is still ongoing, so public answers are limited.

How the break-in happened

The breach traced back to a server used by the child exploitation forensic lab in the FBI's New York field office. According to a timeline written by special agent Aaron Spivack and included in the released documents, protection on that server was unintentionally left exposed while Spivack was working through the bureau's complex rules for handling digital evidence.

The timeline says the break-in took place on 12 February 2023 and was discovered the next day when Spivack turned on his computer and found a text file telling him the network had been compromised. Further checks apparently showed unusual activity on the server, including someone looking through files related to the Epstein investigation.

Who the intruder was and what they did

  • The documents and sources indicate a foreign hacker carried out the intrusion. The person did not seem to know they were inside an FBI server and reacted with disgust when they encountered child abuse material.
  • The intruder left a message threatening to hand over the system owner to law enforcement. Bureau staff then persuaded the hacker they were actually FBI agents. Part of that persuasion involved a video chat during which the agents displayed credentials to the intruder.
  • Investigators found evidence that the intruder had "combed through" Epstein-related files, but the timeline does not list the specific files accessed. It is not clear whether the intruder downloaded any data or what was done with it.

The human side and the paperwork mess

In internal interviews, the agent whose actions left the server exposed said he felt he was being made a scapegoat and blamed conflicting policies and unclear IT guidance. The bureau has not publicly released the final outcome of its internal review.

Why the files matter

Even a lone cybercriminal poking around those documents raises alarm bells because the material touches influential people across politics, business, academia and finance. Experts say any set of files like that is the kind of thing foreign intelligence services would be very interested in, whether for intelligence, leverage or embarrassment.

What we still do not know

  • The intruder's identity, country of origin, and motive remain unconfirmed.
  • Officials have not said which exact documents were accessed or whether the same files overlapped with documents later released publicly.
  • It is unclear whether anyone has been criminally charged or otherwise punished for the break-in.

Context and caution

The justice department has released a large trove of documents tied to the Epstein case, though many pages are heavily redacted and others remain sealed. Officials say some material is still being withheld to protect victims and to avoid jeopardizing active inquiries. The episode is a reminder that even well-guarded systems can be vulnerable when policies and technical setup collide in the wrong way.

This story touches on criminal investigations and sensitive victim material, so public detail will likely remain limited while law enforcement balances transparency with protecting people involved.