Hacktivists Claim Leak of 41,000 DHS Employee Records; Agency Investigating
Summary
Hacktivists calling themselves Department of Peace say they obtained and published an Okta-sourced dataset listing over 41,000 DHS employees. DHS is investigating a potential breach; three employees confirmed their listed names and contact details.
Key points
- Department of Peace claimed it obtained the dataset and shared it with Distributed Denial of Secrets and a hacktivist developer.
- Distributed Denial of Secrets described the data as coming from an Okta single sign-on service used by DHS; the dataset is reported to exceed 165 MB.
- The records reportedly include employee names, offices, contact information and assignments, including personnel associated with covert, undercover and surveillance roles.
- The Icepick site claims the dataset includes over 21,000 Customs and Border Protection agents and nearly 6,600 Immigration and Customs Enforcement employees, among others.
- DHS said it was aware of a potential breach and was working to address it. Three employees contacted by Reuters confirmed their names and contact information were legitimate.
- The site says the dataset is not comprehensive and warns that its source data may contain inaccuracies.
Article Details
- Victim Organization
- U.S. Department of Homeland Security (DHS)
- Incident Type
- Alleged unauthorized access and disclosure of DHS employee data
- Data Types Exposed
- Employee names
- Office information
- Contact information
- Assignments
- Information identifying employees in covert, undercover, and surveillance roles
- Affected Records
- More than 41,000 DHS employee identities, according to the article. The Icepick site claims to include over 21,000 Customs and Border Protection agents and nearly 6,600 Immigration and Customs Enforcement employees, among others.
- Affected Data Size
- More than 165 megabytes
- Operational Impact
- Employee identities and contact details were exposed, including information about personnel in sensitive roles. No operational disruption is reported.
- Ransom Or Extortion
- No ransom demand or financial extortion is reported. Department of Peace described the leak as a riposte to DHS and ICE policies.
- Claim Status
- claimed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | icepi[.]cx | Domain for an online search tool for the leaked DHS dataset; the article says the tool was designed by maia arson crimew. |