In this article
- Hackers published work details and internal group memberships for more than 41,000 DHS workers.
- The data could enable targeted scams, harassment, stalking, or physical threats.
- DHS employees should follow agency guidance, verify unexpected contact, and report threats to security.
A group of hackers calling themselves the Department of Peace says it stole and published the personal details of more than 41,000 people working for the US Department of Homeland Security (DHS). The department says it is aware of a potential breach.
The group, which also claimed the theft of contract documents from the DHS in March, gave the data to Swiss hacktivist maia arson crimew, who published it in collaboration with the transparency collective DDoSecrets. The latter also published the BlueLeaks data dump that listed law enforcement officers’ details in 2020.
The aim of publishing the data was to replace “anonymity with accountability,” DDoSecrets co-founder Emma Best said in an online statement.
According to TechCrunch, timestamps on the records suggest the data was taken around mid-August. The group said it had launched the attack in response to a July 17 statement by DHS Secretary Markwayne Mullin, in which he promised to “turn up the heat” with traffic stops.
What was stolen?
The data files published online, which the publishers have called “Icepick,” span staff at nearly 7,000 offices. They include the names, work email addresses, phone numbers, office addresses, job titles and membership in internal DHS groups. The employees impacted include almost 6,600 Immigration and Customs Enforcement (ICE) employees. ICE is the DHS unit responsible for immigration enforcement and deportations in the US.
The dataset also carried details of over 21,000 Customs and Border Protection (CBP) employees, along with information on people who work at the Cybersecurity and Infrastructure Security Agency (CISA).
The data dump revealed less information than the ShinyHunters’ FBI data heist in September, which reportedly contained Social Security numbers, emergency contacts, medical records and home addresses. Nevertheless, this is more than just a phone book of folks in the DHS.
For one thing, it doesn’t take much to cross-reference data. Reuters matched six DHS employees’ data to credit bureau records and breach data from a dark web intelligence platform. Online activists regularly use open-source intelligence (OSINT) to “doxx” people from very few clues, meaning that even a leak of basic identity information can put someone in danger. In fact, the creators of a separate searchable version say they added information through automated and manual research. So some details shown in that version may not have come from the data stolen from DHS.
Breaches happen every day. Don’t be the last to know.
The data in this case also included membership of groups within Active Directory, a Microsoft tool that contains identity information about computer users. Active Directory controls who can access different internal tools, services, and third-party software within an organization.
The files listed over 200 CBP users in a group that could access the facial recognition tool Mobile Fortify. Other groups reference a service called Penlink, which the company claims can track the location data of hundreds of millions of mobile devices.
According to the Guardian, job titles in the data dump show which agents were assigned to sensitive jobs such as special operations, surveillance, and undercover work.
How did they get the data?
The Department of Peace said that it got to the information via a single sign-on (SSO) service provided by identity company Okta. SSO is a prized target for hackers because a single authentication can get a user into many different workplace services and applications.
Okta says it has no evidence its data or systems were compromised, but that doesn’t rule out someone abusing a DHS account with stolen credentials.
DHS told reporters it was aware of a potential breach. One DHS employee whose data showed up in the breach told Reuters they hadn’t heard anything about it.
What DHS employees can do now
The leaked records include work contact details and internal group memberships. This information could help attackers create convincing messages or calls, and may expose some employees to unwanted attention or threats. DHS has warned about the risk of harassment, stalking, and physical harm. It is not yet clear whether the leak has led to specific threats or affected any operations.
If you work for DHS:
- Follow security advice and instructions from the DHS.
- Treat unexpected calls, emails, and texts about your role or colleagues with caution. Verify them through a contact method you already trust, and never share passwords or MFA codes.
- Change any personal passwords you’ve reused for work, and turn on MFA where available. Follow your agency’s process for work accounts.
- Report suspicious contact or threats to your agency’s security team. If you believe there’s an immediate danger, contact law enforcement.
Do you think your information might have been leaked in a data breach? Check out the Malwarebytes Identity Theft Protection service.
