Hacker steals and leaks data on more than 40,000 US Homeland Security employees

Personal data on thousands of US Department of Homeland Security (DHS) employees has been published online. According to TechCrunch, it was stolen in a breach the department had not previously disclosed.

The leak covers more than 40,000 people and includes names, job titles, and work contact details: email addresses, cell phone numbers, and office locations. Those affected include border and immigration agents, cybersecurity staff, and senior department officials.

Where the data came from

A hacker going by Department of Peace claims the data was taken from an Okta single sign-on system. DHS employees and contractors across its agencies use that system to log in to the central network. It also holds login records and details of which systems and internal apps each user is permitted to access.

More than half of the dataset, about 21,000 records, relates to US Customs and Border Protection (CBP) staff. Around 10,000 more cover Immigration and Customs Enforcement (ICE) and its investigative unit, HSI. Just under 1,000 belong to the cybersecurity agency CISA. The remaining records cover headquarters and other DHS components.

"They have our information, so it's only fair that we have theirs," reads a note the hacker left with the data. The hacker did not respond to TechCrunch's questions. According to TechCrunch, the same hacker earlier this year claimed to have stolen thousands of DHS contracts with private companies.

The data was given to journalist and hacker maia arson crimew, who shared a copy with the nonprofit collective DDoSecrets. TechCrunch verified part of it by checking the names of known employees. Timestamps suggest the records were exfiltrated around mid-August. The leak covers roughly one-fifth of DHS's workforce of about 220,000.

It is unclear whether the vulnerability has been fixed or whether the department knows about the theft. DHS did not respond to a request for comment. Okta said its systems are secure and it has no evidence of compromise.

What the access groups reveal

The leak shows employees' membership in Active Directory groups, and therefore which tools they can use. Most belong to groups for Microsoft 365, Adobe Acrobat, and Citrix. About 4,500 users, including ICE agents, are in a group called "Headspace_users." Online therapy provider Headspace had an $82,500 contract with ICE that ended in 2023. The company says it has not provided services to the agency since then.

Dozens of groups reference Penlink, a web surveillance firm that claims it can track the location of hundreds of millions of mobile devices. One group mentions Penlink PLX, a product for analyzing calls, texts, and social media activity. More than 200 CBP users are linked to Mobile Fortify, a facial-recognition app. The data also shows groups tied to ChatGPT access and to investigations into the China-backed hacking groups Salt Typhoon and Volt Typhoon.

Transparency advocates say the leak could help with Freedom of Information Act (FOIA) requests. Ryan Shapiro, head of the nonprofit Property of the People, said email addresses and phone numbers often separate a stonewalled request from a successful one. DDoSecrets co-founder Emma Best called the data a "catalyst for investigations."

Source: TechCrunch