Hackers Claim Theft and Publication of Data on 41,000 DHS Workers
Summary
The Department of Peace claims it stole and published records on 41,000+ DHS workers, including contact details and internal group memberships. DHS says it is aware of a potential breach; Okta says it has no evidence its systems were compromised.
Key points
- The Department of Peace claims it stole the data through a DHS single sign-on service provided by Okta; the access method has not been independently confirmed.
- The published dataset, called “Icepick,” reportedly covers staff at nearly 7,000 offices and includes names, work contact details, job titles, and internal group memberships.
- The records reportedly include nearly 6,600 ICE employees and more than 21,000 Customs and Border Protection employees, as well as CISA personnel.
- Some group memberships indicate access to internal tools, including a CBP group with more than 200 users that could access the Mobile Fortify facial recognition tool.
- DHS says it is aware of a potential breach. Okta says it has no evidence its systems or data were compromised; the article notes a DHS account could have been abused with stolen credentials.
- The article says specific threats or operational effects from the leak have not been established and advises DHS employees to verify unexpected contact, follow agency guidance, and report threats.
Article Details
- Victim Organization
- US Department of Homeland Security (DHS)
- Incident Type
- Claimed data breach involving theft and publication of employee information
- Data Types Exposed
- Names
- Work email addresses
- Phone numbers
- Office addresses
- Job titles
- Membership in internal DHS groups
- Affected Records
- More than 41,000 people
- Operational Impact
- The leak could enable targeted scams, harassment, stalking, or physical threats. It is unclear whether it led to specific threats or affected operations; no operational impact was reported.
- Ransom Or Extortion
- Unknown
- Claim Status
- claimed
People
Emma BestDDoSecrets co-founder who stated that the aim of publishing the data was to replace “anonymity with accountability.”maia arson crimewDescribed as a Swiss hacktivist who received the dataset from the Department of Peace and published it in collaboration with DDoSecrets.Markwayne MullinDHS Secretary whose July 17 statement was cited by the Department of Peace as the reason for its claimed attack.
Threat Actors
Vendors
MicrosoftThe data in this case also included membership of groups within Active Directory, a Microsoft tool that contains identity information about computer users. Active Directory controls who can access different internalOktaPeace said that it got to the information via a single sign-on (SSO) service provided by identity company Okta. SSO is a prized target for hackers because a single authentication can get a user into many different
Products
Microsoft Active DirectoryThe data in this case also included membership of groups within Active Directory, a Microsoft tool that contains identity information about computer users. Active Directory controls who can access different internalMobile FortifyThe files listed over 200 CBP users in a group that could access the facial recognition tool Mobile Fortify. Other groups reference a service called Penlink, which the company claims can track the location data of