Drop Site is reporting an integrity breach in its purest form, related to the Intercept leaving a dormant Signal username on a “Become a Source” page. The username was taken over and then a social media account describing itself as “Investigative Intake” solicited tips in roughly 100 posts between February and May, pulling in prospective sources.

Drop Site suggests the takeover exploited Signal’s recycling of dormant usernames. The Intercept framed its username switch as “security best practices”. Best practice actually would be an integrity breach notification, but its chief legal officer declined to address how the account had been seized, how long it persisted, or whether prospective sources were warned.

The Intercept executed a silent rebrand instead of a proper breach notification, while promoting itself to journalists for live training on responding “before, during, and after an online attack“.