Homeland Security Personnel Data Stolen in Major Cybersecurity Breach
Hackers exfiltrated sensitive records of 40,000 employees via an Okta single sign-on system.
1Massive Federal Data Exposure
A hacker operating under the handle Department of Peace compromised the U.S. Department of Homeland Security, exposing records of 40,000 employees. The leaked dataset includes names, job titles, email addresses, and office locations. This breach represents approximately one-fifth of the agency's total workforce, impacting personnel across multiple critical federal departments.
2Okta System Vulnerability
The attacker claimed to have obtained the data through an Okta single sign-on system used by the department. This platform manages employee logins and access permissions for internal applications. While the hacker asserts this entry point, Okta stated they have no evidence their own systems or data were compromised during this incident.
3Scope of Impacted Agencies
The breach disproportionately affects U.S. Customs and Border Protection with 21,000 records exposed. Additionally, 10,000 records belong to Immigration and Customs Enforcement and its investigative unit. Smaller groups of affected staff include personnel from CISA, U.S. Citizenship and Immigration Services, and the Federal Protective Service, highlighting the broad reach of the intrusion.
4Internal Access and Tooling
The leaked data reveals employee membership in Active Directory user groups, which control access to internal tools. Many employees were linked to Microsoft 365, Adobe, and Citrix environments. The records also detail access to specialized software, including facial-recognition apps like Mobile Fortify and surveillance technologies provided by contractors such as Penlink.
5Contractor and Software Ties
The dataset highlights connections to third-party services, including a group for Headspace users, despite the company ending its contract with ICE in 2023. Other groups reference Penlink PLX, a surveillance tool used for capturing real-time intelligence from mobile devices. These details provide rare insight into the operational tech stack of federal agencies.
6Verification and Data Origin
TechCrunch verified the authenticity of the data by matching known employee names against the leaked database. Timestamps on the records suggest the exfiltration occurred in mid-August. The data was provided to journalist maia arson crimew and subsequently hosted by DDoSecrets, a nonprofit collective that publishes leaked datasets in the public interest.
7Broader Security Context
This incident follows a series of high-profile government hacks, including the theft of FBI personnel records and Pentagon human resources data. It marks the second time this year that Homeland Security has been targeted by the same hacker, who previously claimed to have stolen thousands of contracts between the department and private vendors.
8Implications for Transparency
Transparency advocates suggest the leaked contact information could serve as a catalyst for future Freedom of Information Act requests. By identifying specific agents and their internal tool access, researchers aim to investigate alleged abuses. The exposure provides a rare, albeit unauthorized, view into the scale and operations of federal immigration and security agencies.
Original article: TechCrunch — Homeland Security Personnel Data Stolen in Major Cybersecurity Breach