More Than 41,000 DHS Employee Records Reportedly Leaked Online
Summary
A hacker using the name Department of Peace claims to have leaked over 41,000 DHS employee records, including personal details and system-access information. Okta says it has no evidence its data or systems were compromised; DHS is addressing a potential breach.
Key points
- The hacker, Department of Peace, claims to have leaked more than 41,000 records and says they came from an Okta single sign-on system; Okta says it has no evidence its data or systems were compromised.
- Most records reportedly concern CBP, ICE and HSI employees; roughly 1,000 CISA employees and personnel from other DHS agencies were also affected.
- The records reportedly include names, work email addresses and phone numbers, job titles, office locations, and information about accounts’ access to systems and internal applications.
- Distributed Denial of Secrets says it obtained a copy of the database, which it calls Icepick, and that the information identifies officials involved in covert operations and DHS programs.
- DHS says it is aware of a potential breach and is working to address the situation.
Article Details
- Victim Organization
- US Department of Homeland Security (DHS)
- Incident Type
- Leak of employee records; the alleged source was an Okta single sign-on system.
- Data Types Exposed
- Names
- Work email addresses
- Phone numbers
- Job titles
- Office locations
- Records of systems and internal applications accessible to each account
- Affected Records
- More than 41,000 employee records
- Operational Impact
- The records were leaked online, and an online search tool was available. The exposed access information could help attackers identify employees and systems to target; this risk was described by Illumio public sector CTO Gary Barlet.
- Ransom Or Extortion
- No ransom demand or extortion activity is reported. The hacker said the leak was retaliation for others having the hacker’s information.
- Claim Status
- alleged
People
Threat Actors
Department of PeaceThe hacker using this handle leaked the records and claimed they were stolen from an Okta single sign-on system used by DHS employees and contractors. The alleged source of the data theft was not confirmed; Okta said it had no evidence its data or systems were compromised.ShinyHuntersThe article describes this group as an extortion group and reports that it breached FBI systems one month before the DHS records leak.