Hackers Leak Data on More Than 40,000 Homeland Security Employees

A hacking group has published a searchable database covering tens of thousands of Department of Homeland Security employees and contractors, including staff assigned to undercover and covert work, in one of the largest exposures of the agency’s workforce data. The files were released on Wednesday, Reuters and CyberScoop reported.

The group calls itself the Department of Peace. Outlets differ on the count: CyberScoop said more than 41,000 people, Reuters said more than 40,000, and Straight Arrow News said almost 42,000, which it described as about one-fifth of the agency’s workforce. According to Reuters, the records include names, phone numbers, email addresses, job titles and email groups. Straight Arrow News reported that some entries carry group labels such as “Undercover Operations” and “Covert Operations,” and that the data span components including ICE, Customs and Border Protection, Homeland Security Investigations, CISA and USCIS.

A spokesperson for the group told CyberScoop it obtained the data through DHS’s Okta single sign-on service, a claim Reuters said it could not corroborate. Okta said in a statement carried by both outlets, “Okta is secure, and we have no evidence our data or systems were compromised.” Straight Arrow News wrote that it is not clear when the intrusion occurred. The group cited Secretary Markwayne Mullin’s July 17 remark that he was “turning up the heat” on immigration enforcement as a motive, according to CyberScoop.

The transparency group Distributed Denial of Secrets published the dataset, CyberScoop and Reuters reported, and a searchable version was built by an independent hacker and journalist. CyberScoop said the search site was offline by Thursday morning. Emma Best, a co-founder of the transparency group, said in comments Reuters reported that the release would “replace anonymity with accountability.” Ryan Shapiro of the transparency group Property of the People told CyberScoop that the emails and phone numbers are “indispensable tools for FOIA researchers.”

Reuters said it could not immediately verify the whole trove. It matched personal details for six named employees to credit-bureau and breach records and reached three by phone, who confirmed their information; one said it was the first they had heard of a breach. DHS did not immediately respond to the outlets’ requests when they published.

The argument for publishing is accountability for an agency whose officers often work masked and whose roster is not public. The argument against is about safety and the law: exposing the names, phone numbers and email addresses of undercover personnel can put them and their families at risk, and DHS has cited rising threats to employees in defending its secrecy, Straight Arrow News reported. Distributing government personnel data taken in an intrusion is also likely to draw a federal investigation.

The same group claimed responsibility in March for hacking DHS and posting documents about contracts with outside vendors, Reuters reported. CyberScoop noted that DHS has had earlier large breaches of employee data.