DHS Data on More Than 41,000 Employees Leaked Online

The database includes names, work email addresses, phone numbers, job titles and office locations for employees and contractors at the U.S. Department of Homeland Security. It also contains records showing which internal systems and applications individual accounts can access.

Most of the records concern personnel at U.S. Customs and Border Protection, Immigration and Customs Enforcement, and Homeland Security Investigations. Information on about 1,000 Cybersecurity and Infrastructure Security Agency employees and staff at several other DHS agencies is included as well.

The hacker claims the data came from an Okta single sign-on system used by DHS personnel to access the department’s central environment. An online tool that allows users to search the leaked information has also been made available.

Distributed Denial of Secrets, which obtained a copy of the database and calls it “Icepick,” said the records identify officials involved in covert and undercover operations and personnel connected to DHS rendition and deportation programs.

“They have our information, so it’s only fair that we have theirs,” the hacker wrote in a note accompanying the release.

Okta reviewed the report and found no evidence that its systems or data had been compromised. “Okta is secure, and we have no evidence our data or systems were compromised,” a company spokesperson said.

DHS confirmed it was aware of a potential breach and was working to address it. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected,” a department spokesperson said. The department plans to provide more information when it becomes available.

Gary Barlet, public sector chief technology officer at Illumio, said the system-access information could help attackers identify employees and applications to target. “If an attacker knows which employees have access to which systems and applications, they’ve essentially been handed a roadmap for where to go next and who to target to get there,” he said.

The disclosure came one month after the ShinyHunters extortion group breached FBI systems and three months after the Homeland Security Information Network was hacked.