The Romanian hacker who first exposed Hillary Clinton's private email address is making a bombshell new claim — that he also gained access to the former Secretary of State's "completely unsecured" server.
“It was like an open orchid on the Internet,” Marcel Lehel Lazar, who uses the devilish handle Guccifer, told NBC News in an exclusive interview from a prison in Bucharest.
“There were hundreds of folders.”
For more of Cynthia McFadden's interview with Guccifer, watch Nightly News on Thursday and the new NBC series "On Assignment," which debuts Sunday at 7 p.m. ET/ 6 p.m. CT.
Lazar — who peppers conversation with wild conspiracy theories and even racist comments — is no longer in Romania.
He was extradited last month to the United States to face charges he hacked political elites, including Gen. Colin Powell, a member of the Bush family, and former Clinton advisor Sidney Blumenthal.
A source said he was escorted to a Virginia jail by FBI agents who spoke to him in transit. Officials emphasize that investigators have seen nothing so far to substantiate his claim but that the investigation continues.
Lazar, 44, did not give any proof to back up his claim and would not provide copies of the emails he said he downloaded from the Clinton server.
Still, a former FBI special agent who ran major cybersecurity probes found his story credible.
NBC News asked Chris Tarbell, who broke open the Silk Road case, to review Lazar's explanation of how he got into the server.
“It’s plausible,” Chris Tarbell said, adding that Lazar's conviction for hacking in Romania showed he had the know-how to carry it out.
Tarbell added that he could not imagine why Lazar would make up a claim that could get him in very hot water.
“To go on television and admit to a felony you didn’t commit seems a little silly,” he said.
Although Lazar has pleaded not guilty to the federal criminal charges, he boasted about the Internet intrusions in his first American on-camera interview — which can be seen Thursday on NBC Nightly News and Sunday on Dateline’s “On Assignment” premiere.
The unemployed taxi driver recounted how he used a cheap computer and cellphone – and intensive research that allowed him to guess passwords and security clues -- to make a name for himself in Romania, which is such a hotbed for hackers and cyber-scammers that the FBI set up a permanent office there.
He set his sights on Washington, hoping to uncover evidence to support his outlandish belief that an international cabal called the Illuminati is secretly controlling world affairs.
He admits he raided the email of Dorothy Bush Koch, revealing to the world that her brother, President George Bush, was an amateur painter and her father, President George H.W. Bush, was ill. When he seized control of Powell’s Facebook page, he left a message, “You will burn in hell, Bush!”
But it was Blumenthal’s account, hacked in 2013, that yielded the biggest secret — emails from hdr22@clintonemail.com. Guccifer said he noted the initials matched Clinton’s maiden name, Hillary Diane Rodham — a “wow moment,” he called it.
By his account, he used the data in the header of the emails as a road map to her server.
“By running a scan, I found that server…that was completely unsecured,” he said.
Once inside, he was able to view and download emails, he claimed.
“It was not what I was looking for,” he sniffed. “It was boring stuff.”
That was two years before the New York Times reported that Clinton had used the HDR22 email for all her State Department business and that she had a private server in her Chappaqua, New York, home.
As political opponents charged that national security was compromised and the FBI launched an investigation, Clinton maintained that the server was safe and there were no security breaks.
“It was a lie, clearly,” Lazar said.
Tarbell, however, notes that the handiwork of a hacker like Guccifer is built on dishonesty.
“They're a pathological, well-practiced liar,” he said.
Clinton’s presidential campaign said Lazar’s claims were baseless.
"There is absolutely no basis to believe the claims made by this criminal from his prison cell," Brian Fallon, the campaign press secretary.
"In addition to the fact that he offers no proof to support his claims, his descriptions of Secretary Clinton's server are inaccurate. It is unfathomable that he would have gained access to her emails and not leaked them the way he did to his other victims.
"We have received no indication from any government agency to support these claims, nor are they reflected in the range of charges that Guccifer already faces and that prompted his extradition in the first place," Fallon added. "And it has been reported that security logs from Secretary Clinton's email server do not show any evidence of foreign hacking."
A source familiar with the Clinton case confirmed to NBC News that the FBI’s review of her server logs showed no signs of foreign hacking, but Tarbell said that such logs may not be comprehensive and don’t rule out a breach.
It’s unclear what impact Lazar’s story could have on Clinton’s presidential prospects, but one of her biggest critics, Sen. Chuck Grassley, R-Iowa, fired off a letter last month asking if she knew whether or not the Romanian had accessed her server.
For his part, Guccifer said he never intended to influence the presidential race, though he seems to relish the idea that he could.
“At that time I wasn't even thinking about the electoral campaign of 2016,” he said of his 2013 exploits. “But that's where things are heading.”
