Hacker Leaks Personal Data of 40,000 DHS Employees
A massive data breach exposes sensitive contact information and system access records for federal staff.
1Massive Federal Data Exposure
A hacker known as Department of Peace leaked personal data belonging to over 40,000 Department of Homeland Security employees. The breach includes names, job titles, email addresses, and office locations. This incident, which occurred earlier this year but remained undisclosed until recently, impacts staff across multiple critical federal agencies and departments.
2Scope of Affected Agencies
The leaked records cover approximately one-fifth of the total 220,000 DHS workforce. Specifically, 21,000 records belong to Customs and Border Protection staff at ports of entry. Additionally, 10,000 records are linked to Immigration and Customs Enforcement, while nearly 1,000 records involve CISA cybersecurity personnel, alongside staff from various other internal agencies.
3Okta System Access Point
The attacker claims the data was exfiltrated from an Okta single sign-on system used by the department. This platform manages access for employees and contractors to the central network. It also stores login records, revealing which internal applications and IT tools each individual user is authorized to access within the federal infrastructure.
4Exposed Software and Tools
The database reveals employee access to sensitive tools, including Microsoft 365 and ChatGPT. Furthermore, it details usage of specialized software like Penlink for surveillance and Mobile Fortify, a facial recognition application utilized by CBP and ICE. Over 4,500 accounts were linked to a Headspace user group, highlighting broad software integration across the department.
5Motivations Behind the Leak
The hacker stated the leak was a direct response to government actions taken against ICE. By releasing the database, the actor aimed to remove the anonymity of officials involved in deportation and rendition programs. The perpetrator left a note suggesting that sharing this information was a matter of fairness regarding government data practices.
6Research and Accountability Implications
DDoSecrets, which published the database under the name Icepick, claims it provides an unprecedented view of the DHS organizational structure. Researchers suggest the data will facilitate targeted Freedom of Information Act requests. It identifies officials responsible for covert operations, internal investigations, and policy drivers, potentially aiding journalists and legal challenges against the agency.
7Official Response and Investigation
DHS confirmed awareness of the potential breach and is currently conducting an active investigation. A spokesperson emphasized that the department takes threats against its officers seriously and intends to provide updates as more information becomes available. Meanwhile, Okta stated it has no evidence that its own systems or proprietary data were compromised.
8Context of Government Breaches
This incident follows previous high-profile attacks on U.S. government agencies that exposed FBI records and military personnel data. It marks the second major DHS breach this year, following a previous claim by the same hacker regarding stolen government contracts. The situation highlights ongoing vulnerabilities in federal identity management and internal network security protocols.
Original article: Security Affairs — Hacker Leaks Personal Data of 40,000 DHS Employees