Dialog breached: data on the world's most influential people has leaked

Dialog breached: data on the world's most influential people has leaked

In June 2026, a leak opened an unexpected window onto Dialog, a private network where political leaders, tech billionaires, senior officials, military figures, academics, investors and other influential people cross paths. The service presents itself as an extremely exclusive space, designed to let its members build relationships and talk behind closed doors. Information about how it works and who takes part was supposed to remain confidential.

Yet a disarmingly simple development error exposed a vast set of data: identities, personal email addresses, assistants' contact details, postal addresses, phone numbers, dietary preferences, book recommendations, political answers, attendance information and even relationship status. Some records showed who was looking for a partner and who preferred to stay out of the matchmaking scheme.

Most astonishing of all, the discovery required no sophisticated intrusion, no malware and no covert operation. For part of the information, all it took was opening the browser's developer tools. One key, F12, gave access to what Dialog itself had sent to every visitor.

This story reveals how a long-opaque circle operates. Above all, it shows that the social, financial or political standing of the people concerned offers no protection against basic cybersecurity mistakes.

A club you can only join by invitation

Dialog remains little known to the general public because it does not seek a public. Its website explains that it is an invitation-only community. To have any hope of joining, you must have accomplished something exceptional and be recommended by a participant. The line on its home page sums up its positioning: leaders join Dialog to discuss topics that must not be publicly attributed.

The network has existed since 2006. It was co-founded by Peter Thiel, co-founder of PayPal and Palantir, and the entrepreneur Auren Hoffman. The latter has also built companies involved in collecting, resolving identities from and analysing data, notably from mobile devices. Dialog was conceived as a closed club bringing together senior officials and business leaders from around the world.

Over the years, its gatherings have hosted or invited senators, academics, investors, representatives of major funds and think tanks, as well as some film personalities. Actors do not directly shape public policy, but they often serve as the faces of national, humanitarian or global initiatives. For a network built on influence and relationships, their presence therefore has obvious value.

For nearly twenty years, Dialog kept a tiny public footprint. Its real influence could only be estimated from fragments published in the press and anonymous accounts from former participants. Most citizens did not even try to assess it, since they did not know the organisation existed.

The programme for the Irish gathering

The June leak revealed preparations for a retreat planned for August 2026 near Dublin. The leisure activities included private distillery tours, a visit to St Patrick's Cathedral, a Guinness experience and several activities organised in the Irish countryside. The contrast between the supposed power of the guests and the very conventional nature of this programme is not without irony.

The working sessions were more revealing. The programme included discussions whose titles translate as "Bringing back nuclear", "Navigating World War III", "Battlefield technologies", "Disinformation and deepfakes" and "Three predictions for Iran". A session on democracy under surveillance took on particular significance in a network co-founded by people closely tied to the global data and surveillance industry.

Other titles seemed to come straight from a round table of film villains: "How is your sex life?", "Can money buy happiness?", "Building a cult" and "Building a party". The documents do not make it possible to reconstruct what was to be said during these exchanges, nor to determine the exact positions of the invited guests.

After the leak was revealed and the controversy that followed in Ireland, the gathering planned for 12 to 16 August at the Powerscourt Hotel was cancelled by the venue. Moreover, an invitation or an appearance in the files does not prove that a person attended a meeting, shares a founder's ideas or is still a member of the network.

A list where power, technology and finance meet

The leaked files contained more than two hundred names linked to the 2026 retreat, while a broader directory brought together members, former participants, speakers and guests. It included senior Saudi officials, former ministers, finance executives, military leaders, US senators from both parties and several Silicon Valley figures.

Among the names cited were Elon Musk, long connected to Peter Thiel through the history of PayPal, Jonathan Levin, president of Stanford University, the neuroscientist Sam Harris, the European Union's High Representative Kaja Kallas, the entrepreneur Bryan Johnson, known for his longevity experiments, and the journalist Ezra Klein.

The list also included Sarah Bond, president of Xbox, Strauss Zelnick, head of Take-Two Interactive, Jason Kwon, chief strategy officer at OpenAI, former Pakistani prime minister Shahid Khaqan Abbasi and former Japanese digital minister Taro Kono. Garry Kasparov appeared as world chess champion and former member of the Russian opposition's Coordination Council.

These names must be interpreted with caution. The files mixed different categories and periods. After the leak, some people explained that they had only attended an earlier meeting, that they had been invited without accepting or that they did not know why their name was in the directory. Even with this caveat, the whole offers a rare glimpse into a network where public power, finance, intelligence, the tech industry and the production of ideas intersect.

A "hack" that took a single key

The discovery was made public by maia arson crimew, a Swiss hacktivist and security researcher. She had previously become known for her involvement in the Arson Cats group and for the 2021 Verkada affair, in which access to some 150,000 surveillance cameras was exposed, including in a Tesla factory and an Alabama prison. That operation aimed to show the scale of surveillance deployed by technology companies.

In the Dialog case, two anonymous sources guided the research. The first was exploring the Jeffrey Epstein files released by the US Department of Justice. It noticed that a Dialog invitation intended for another speaker had been forwarded to him in 2012. Another exchange, dated 2016, alluded to Peter Thiel's failure to create a secret society. These documents suggested at least indirect knowledge of Dialog, without establishing whether Epstein had been a member.

The second source advised examining the website dedicated to the Irish retreat. This is where the story becomes almost absurd: part of the data did not need to be hacked. It was already accessible on Dialog's own services, without adequate protection.

A web page does not contain only what the screen displays. The browser receives HTML, scripts, style sheets and often data objects used to build the interface. Visually hiding an element does not prevent it from being transmitted. When confidential data reaches the browser, it must be considered accessible to the user, even if no button displays it.

By opening the developer tools, available with F12 in most browsers, maia arson crimew found a directory of participants in the page's code. The site looked almost empty, but its code carried information the organisation had always refused to publish. A version containing this directory had even been captured by a web archiving service before being removed.

Viewing the code delivered by a server does not, in itself, amount to bypassing a protection. The browser needs that code to display the page. The essential mistake was sending the client data that should never have left an authenticated and authorised environment.

Registration without a password and open records

Examining the second site, the one used to register for the Dublin gathering, revealed another weakness. It was possible to log in with practically any email address, without a password. Once logged in, the user could view the other guests' records.

The forms were filled in using the Fillout service and then stored in an Airtable base. The data included private information and personalised access tokens that could function as credentials. The irony is striking: Airtable's founder and CEO was himself among those invited to the retreat.

The situation is spectacular because of who was affected and because of Dialog's secretive nature. Technically, however, it remains very ordinary. Many services are assembled quickly from third-party tools, ready-made forms and online databases. When they age for years without a real authorisation model, basic errors eventually expose considerable volumes of data.

The same flaw, again and again

Leaving a database without a password or displaying other users' objects without checking their rights is among the most common mistakes. A dating and relationship discussion app exposed profiles, messages, documents and photos of tens of thousands of users because an administrative database was directly reachable from the Internet.

The website BeautifulPeople.com suffered a comparable leak in 2015: an insufficiently protected database could be viewed by anyone who found its address. In October 2025, conversations from the virtual girlfriend service MyLovelyAI were exposed through a Kafka messaging infrastructure accessible without adequate control.

In early 2026, the connected toy Bondu, a small dinosaur using a conversational agent, illustrated another variant of the problem. Children's conversations were transferred to the cloud so that their parents could view them. But the portal did not properly check whether the logged-in account was entitled to access a given conversation. A user could thus reach other families' exchanges.

Dialog reproduced these mistakes at a particularly sensitive level. The showcase site and the event form were probably regarded as secondary functions. They may have been entrusted to a small team, developed quickly and connected to external services without an in-depth security review. The explanation is mundane: the human factor is enough. Its consequences are not.

What the files really said about the network

The leak was not only about dietary preferences, favourite books or amusing answers to a form. It also revealed the organisation's internal structure.

Dialog assigned members and guests scores linked to their fame, wealth and usefulness to the network. The records included categories and a "value add" score. People deemed less influential, less well known or less suited to the group's culture could stop receiving invitations. The ratings were also used to decide seating, who should be introduced to whom and, in some cases, the price charged to attend.

The files also exposed a professional and romantic matchmaking system. The suggested matches, whether for networking or dating, remained attached to the profiles. By combining this information, it became possible to reconstruct a social graph: who knows whom, who should be introduced to whom, which relationships are avoided and who can exert influence over someone else.

Such a dataset is naturally of interest to intelligence services, unscrupulous business competitors, criminal groups and perpetrators of targeted attacks. The presence of business leaders alone would already be sensitive. That of military leaders, generals and officials close to national security turns detailed tracking of their interactions into a strategic risk.

Ideal raw material for targeted phishing

Any personal information about an influential figure can be used to prepare an attack. A private address, an assistant's name, a travel date, an allergy, a recently recommended book or an anticipated introduction give a fraudulent message unusual credibility.

An attacker no longer needs to send a generic email. They can pose as the organiser of a session, use the exact name of a participant, mention a planned activity and ask the recipient to open a document or confirm a record. The more precise the context, the more likely the victim is to see the request as legitimate.

The leak also makes it easier to attack the people around the targets. Assistants, communications teams, drivers, contractors and relatives sometimes have indirect access to the target's calendars and documents. Their security may be weaker, while their information makes it possible to take a first step towards the main target.

The risk is therefore not limited to the people whose contact details were exposed. A relationship graph makes it possible to identify intermediaries, points of trust and the most promising channels. For intelligence services or organised crime groups, such a map may be worth more than a list of passwords.

The browser should only receive what it can show

The first lesson is technical and fundamental: hiding data in the interface is never an access control. Permissions must be checked on the server side, for every requested object and every user. The server must return only the records the authenticated person is entitled to view.

An application must also separate its public environments, event forms, private directory and administrative tools. Every integration with a third-party service must be assessed: what data is transmitted, where is it stored, which links give access to records, how long do they remain valid and what happens if someone copies them?

Tokens placed in URLs must be short-lived, revocable and limited to a specific action. Passwordless authentication can be secure when it relies on a single-use link that expires quickly and is sent to a previously verified address. Accepting any address and then opening an entire directory is not a simplified login: it is a lack of authorisation.

Finally, public pages and temporary forms deserve the same review as the main product. An organisation can invest heavily in the security of its core platform and still lose its data through a microsite created for a single event.

Preparing for the leak before it happens

Any secret information may one day become public. When an organisation holds confidential data, it must protect it, but also decide in advance how to react if that protection fails. No system guarantees zero risk.

A response plan must cover identifying the data affected, immediately revoking tokens, informing the people concerned, preserving evidence, analysing access and monitoring phishing campaigns that might exploit the leak. Teams must know who makes the decision, who communicates and who protects the most exposed accounts.

The second lesson concerns the human factor. The weakest link in a security system may be a user, a developer, an administrator or the person responsible for approving a release to production. This holds true for an individual's phone as much as for a network frequented by the most powerful people in the world.

Security therefore does not depend on an organisation's prestige. It depends on concrete practices: limiting the data collected, checking every authorisation on the server side, testing applications as an outside user would, reviewing integrations, monitoring exposures and preparing the incident response. Dialog wanted to offer its members a space where everything would remain confidential. An almost empty page and a poorly protected form were enough to prove otherwise.