Hackers leak data on more than 40,000 DHS employees

A hacktivist group calling itself Department of Peace says it stole personnel records on more than 40,000 people working for the U.S. Department of Homeland Security. The data include names, job titles, email addresses, phone numbers and office locations. It was published online after being shared with the nonprofit DDoSecrets.

Affected agencies and personnel

The records cover workers at Customs and Border Protection, Immigration and Customs Enforcement, the Homeland Security Investigations unit, the Cybersecurity and Infrastructure Security Agency and other DHS agencies. About 21,000 records belong to CBP staff and about 10,000 to ICE personnel. About a third of the ICE records relate to HSI investigators, and just under 1,000 belong to CISA staff. The list also shows which internal applications employees can access, including Microsoft 365, Adobe Acrobat, Citrix, Headspace and Penlink.

The hacker claims to have got the data through Okta, the single sign-on service DHS uses for employee logins. Okta said it has no evidence its data or systems were compromised. The data were shared with DDoSecrets, which built a searchable database called Icepick. A note left with the records said, “They have our information, so it’s only fair that we have theirs.”

A DHS spokesperson said the agency is aware of a potential breach and is working to address the situation swiftly and effectively. DHS said it will update the public when more information is available. The leak is the third major U.S. government data breach in recent weeks, after incidents involving the Defense Department and the FBI.