A hacker leaks personal data on more than 40,000 DHS employees, including CBP, ICE and CISA staff, after an undisclosed breach.
Personal details of thousands of U.S. Department of Homeland Security (DHS) employees are now online after a hacker stole reams of data in a data breach that occurred earlier this year and nobody had disclosed.
“The breach includes names, job titles, and work contact information, such as email addresses, cell phone numbers, and office locations, of more than 40,000 people who work for the federal department, including border and immigration agents, cybersecurity staffers, and senior department officials.” TechCrunch reports.
The incident impacted border and immigration agents, cybersecurity staff and senior department officials. DHS confirmed it is aware of a potential breach and is investigating, saying it takes threats to employees seriously and will provide updates when more information is available.
“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available,” a DHS spokesperson told SecurityWeek.
The hacker, who uses the name Department of Peace, claims to have stolen the data from an Okta single sign-on system. DHS uses this service to give employees and contractors across its agencies access to the department’s central network. The system also stores IT and login records for each account, showing which systems and internal apps each person can access. The hacker left a note with the leaked data, seen by TechCrunch, saying that if others have their information, it is only fair to share theirs. The malicious actor did not reveal how the U.S. agency was breached.
More than half of the records, around 21,000, belong to U.S. Customs and Border Protection (CBP) employees working at airports and other ports of entry. Another 10,000 belong to Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations unit, while just under 1,000 are linked to the cybersecurity agency CISA. Thousands of other records belong to DHS headquarters and agencies such as U.S. Citizenship and Immigration Services and the Federal Protective Service.
DDoSecrets says the leaked database identifies officials involved in undercover operations and key DHS personnel overseeing renditions and deportations. Department of Peace said the leak was a response to the government’s actions against ICE. Crimew described the database as an unprecedented view of DHS’s organizational structure, helping researchers identify employees, their roles and reporting lines. They said it could also support investigations and future Freedom of Information Act (FOIA) requests.
DDoSecrets co-founder Emma Best said the database, called Icepick, identifies officials involved in covert operations, internal investigations and deportation programs. Ryan Shapiro of Property of the People added that employee contact details could help researchers submit more targeted FOIA requests. Best said the data could also support journalism, congressional inquiries, legal challenges and community investigations.
“Rather than an indiscriminate directory of every DHS employee, Icepick identifies many of the architects and drivers of DHS policy and operations,” said journalist and DDoSecrets cofounder Emma Best. “The leak is extraordinary but deceptive in its simplicity as it identifies the officials responsible for overseeing covert and undercover operations, the government’s hunt for leakers and the failed BlueLeaks investigation — along with key personnel in DHS’s ever-escalating rendition and deportation programs.”
“By replacing the regime’s anonymity with accountability, Icepick and the tool developed by maia are catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests,” added Best.
DHS is investigating a potential breach. Okta says it has no evidence its systems or data were compromised.
The breach follows other attacks on U.S. government agencies that exposed FBI records and military personnel data. It is also the second DHS breach this year, after the same hacker claimed to have stolen thousands of government contracts.
Journalist maia arson crimew shared the data with DDoSecrets. TechCrunch verified some records, which suggest the database was copied around mid-August. The leak covers about one-fifth of DHS’s 220,000 employees.
The records reveal access to tools including Microsoft 365, ChatGPT, Penlink surveillance software and Mobile Fortify, a facial recognition app used by CBP and ICE. Around 4,500 accounts belong to a Headspace user group, while more than 2,000 Homeland Security Investigations employees appear in Penlink-related groups.
Researchers say the contact details could help journalists file targeted Freedom of Information Act requests. However, exposing employees’ phone numbers and office locations also creates security and privacy risks.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, DHS)
Entrar
