Homeland Security Suffers Undisclosed Breach
Personally identifiable information belonging to thousands of U.S. Department of Homeland Security (DHS) employees has been published online after a hacker stole reams of data in a previously undisclosed breach earlier this year.
Scope of the Leaked Data
The breach includes names, job titles, and work contact information—such as email addresses, cell phone numbers, and office locations—of more than 40,000 people who work for the federal department, including border and immigration agents, cybersecurity staffers, and senior department officials.
More than half of the dataset—some 21,000 records—relates to employees of U.S. Customs and Border Protection (CBP), who work at airports and other ports of entry. The data also contains records associated with another 10,000 employees of Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) unit, along with just under 1,000 employees at the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
Thousands of additional records relate to staff at the department's headquarters and its other agencies, including U.S. Citizenship and Immigration Services and the Federal Protective Service.
How the Breach Occurred
A hacker operating under the handle "Department of Peace" claimed to have obtained the data from an Okta single sign-on system used by Homeland Security to allow employees and contractors across its various agencies to log in to its central network. The Okta system also contains IT and login records associated with employees' user accounts, including details about which systems and internal apps they are permitted to access.
"They have our information, so it's only fair that we have theirs," the hacker said in a note left with the data, which TechCrunch has seen. Department of Peace did not respond to TechCrunch's email requesting comment or to questions about how the breach was carried out.
A Pattern of Federal Breaches
This is the latest data breach to hit the U.S. government in recent months, following earlier hacks involving the theft of thousands of FBI agents' personnel records and the personal information of millions of serving and former military service personnel from the Pentagon's human resources unit. It is also the second breach involving Homeland Security this year, after the same hacker claimed to have taken thousands of contracts between the department and the private sector, including defense contractors and surveillance vendors.
The latest batch of breached data, which appears authentic, offers a rare—albeit incomplete—view into the scale and operations of Homeland Security, whose deportations, arbitrary detentions, and killings of U.S. citizens under its leadership have become a key issue for voters ahead of the upcoming U.S. midterm elections.
Distribution and Verification
The stolen Homeland Security data was provided to journalist and hacker maia arson crimew, who then shared a copy with DDoSecrets, a nonprofit collective that hosts leaked datasets in the public interest.
TechCrunch verified a portion of the data as authentic by matching the names of several known Homeland Security employees against an offline copy of the database. According to timestamps on each person's record, the thousands of employee directory records appear to have been exfiltrated around mid-August. The number of leaked records is equivalent to about one-fifth of Homeland Security's workforce, which totals around 220,000 staff.
Response and Open Questions
It remains unclear whether the vulnerability that enabled the breach has been fixed or whether Homeland Security is aware of the data theft.
A spokesperson for Homeland Security did not immediately respond to TechCrunch's request for comment about the breach.
When reached, Okta said it was aware of the report. "Okta is secure, and we have no evidence" of a compromise, the company said, though it did not elaborate further at the time of publication.
via TechCrunch