DHS Data Breach: 41,000 Employee Records Exposed

A hacker named the Department of Peace stole personal information for more than 41,000 Department of Homeland Security employees. The compromised data includes names, job titles, phone numbers, email addresses, and specific office locations. This breach affects staff across multiple agencies, including US Immigration and Customs Enforcement and Customs and Border Protection.

TechCrunch and Wired reported that the hacker gained access through Okta, an identity and access management service used by the department. Approximately 21,000 records belong to Customs and Border Protection employees, while nearly 7,000 are for staff at US Immigration and Customs Enforcement. The dataset also includes records from the Cybersecurity and Infrastructure Security Agency, US Citizenship and Immigration Services, and Homeland Security Investigations.

The leaked files link specific DHS groups to surveillance tools. These include Mobile Fortify, a facial recognition app, and PenLink, a system that collects and analyzes data from phones and online services. The data was shared with cybersecurity researcher maia arson crimew, who passed it to Distributed Denial of Secrets. That nonprofit now hosts the collection, which they have labeled the Icepick dataset.

The hacker cited the department's tracking of online critics as a reason for the release. They stated, 'They have our information, so it’s only fair that we have theirs.' This incident follows a similar hack that stole data from the FBI regarding its employees and job applicants just weeks ago.

The Department of Homeland Security has not yet responded to a request for comment. The department has previously worked to keep the identities of Customs and Border Protection and US Immigration and Customs Enforcement agents private while they conduct raids and track digital opponents.

The exposure of office locations and direct contact details provides a detailed map of the personnel involved in these operations. The release confirms which internal teams have access to the specific software tools used for monitoring.