Data of Over 41,000 DHS Employees Leaked by Hacktivist Group

Significant Data Breach at DHS

On October 28, a nonprofit organization named Distributed Denial of Secrets made public a dataset known as Icepick, containing sensitive information about 41,191 employees and contractors of the Department of Homeland Security (DHS). This leak includes details for 21,329 personnel from Customs and Border Protection and approximately 10,000 from Immigration and Customs Enforcement (ICE).

Claims of Unauthorized Access

A hacktivist group calling itself the Department of Peace claims responsibility for the breach, stating that they accessed the records through an Okta login service utilized by the DHS. However, Okta has denied these claims, asserting that there is no evidence that its systems were compromised.

Scope of the Data Leak

The published dataset functions as a directory, revealing names, job titles, office locations, and phone numbers of DHS staff. While transparency advocates view this information as valuable for public record requests, security experts warn that it could be exploited for impersonation or to identify individuals involved in sensitive investigations.

According to Emma Best, co-founder of Distributed Denial of Secrets, the dataset does not contain home addresses. The leaked information also includes over 55,000 internal permission groups, which dictate access to various systems within the department.

DHS Response

The DHS has acknowledged the potential breach and is working to mitigate the situation, having filed a takedown notice to remove the leaked information. A department spokesperson stated, "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively." As a result, the website hosting the dataset has ceased functioning, and links to the nonprofit are being blocked on certain platforms.

This incident follows a previous claim by the cybercrime group ShinyHunters, which asserted they possessed extensive data on FBI agents, prompting concerns about the security of personal information among federal employees.