Icepick Archive of DHS Employee Data Returns After Registrar Suspension
Summary
Icepick, a search tool for information on more than 41,000 DHS employees, briefly went offline after a registrar suspension and later returned under a different registrar. Hacktivists claimed the data came from a breached DHS database; DHS said it was investigating a “潜
Key points
- Hacktivists said the Icepick database contained information on more than 41,000 DHS employees obtained from a breached DHS database; the article does not independently confirm the claim.
- DHS described the incident as a potential breach and said it was working to protect employees.
- FlokiNET said it refused a takedown request from DHS contractor ZeroFox, while registrar CentralNic placed the site's domain on serverHold.
- The search tool later came back online under a domain registered with a different registrar.
- ZeroFox argued the data was stolen and could identify and locate people; FlokiNET disputed characterizing the archive as doxxing.
Article Details
- Victim Organization
- Department of Homeland Security
- Incident Type
- Alleged breach of a DHS database and exposure of employee information through the Icepick search tool
- Data Types Exposed
- Employee work identities
- Names
- Roles
- Work contact information
- Affected Records
- More than 41,000 employees, according to the article
- Operational Impact
- The Icepick database search tool went offline temporarily after its registrar placed the domain on serverHold, then came online under a different registrar. DHS said it was working to protect employees; the extent of any breach was not confirmed.
- Ransom Or Extortion
- None reported
- Claim Status
- claimed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | icepi[.]cx | Domain used by the Icepick search tool to provide access to a database that hacktivists claimed was stolen from DHS; the domain was temporarily placed on serverHold. |
Vendors
BlueskyThe social media site Bluesky was also blocking links to the archive because it shared people’s contact information without their permission, although a company official said changes were coming because the wording hadCentralNicIts registrar, CentralNic, had placed the domain on serverHold,” FlokiNET said in a blog post.FlokiNETIcelandic hosting company FlokiNET said Thursday that it received a request from DHS contractor ZeroFox to remove the data, which it refused.ZeroFoxIcelandic hosting company FlokiNET said Thursday that it received a request from DHS contractor ZeroFox to remove the data, which it refused.