Data on More Than 40,000 Homeland Security Employees Leaks Online
A leak site published records for more than 40,000 Department of Homeland Security employees on Wednesday, including staff in surveillance and undercover roles. The department says it is working to protect those named. The company behind the login system named in the leak says its systems were not compromised.
The leak site Distributed Denial of Secrets published a database on Wednesday covering more than 40,000 Department of Homeland Security employees, Reuters and NPR reported. The database, called Icepick, includes names, phone numbers, email addresses, job titles, and office locations.
The records cover about a fifth of the department's workforce of more than 220,000 people. More than 21,000 of them identify employees of U.S. Customs and Border Protection, NPR reported. Another 10,000 relate to Immigration and Customs Enforcement and its Homeland Security Investigations unit. Staff from the Cybersecurity and Infrastructure Security Agency and other components are also in the set.
What makes the set unusual is not just its size. The job titles and email groups in it show which agents were assigned to special operations, surveillance, computer forensics, and undercover work, Reuters reported. In some cases the data revealed internal organization charts and programs that had not been public.
How the data got out, and what is disputed
The group that supplied the data calls itself the Department of Peace. It said it took the records by subverting the department's single sign-on system, which is run by Okta. Reuters said it could not corroborate that claim. Okta said its systems were not breached.
"Okta is secure, and we have no evidence our data or systems were compromised," Okta said in response to a Reuters query.
Reuters was able to check parts of the trove. It matched personal information for six employees named in the leak to credit bureau records and breach data, and it called three employees directly and confirmed their phone numbers and other details. One of them told Reuters it was the first they had heard of a breach. Reuters said it could not verify the authenticity of the entire set.
TechCrunch, which also reviewed the data, reported that timestamps in the records suggest they were taken around mid-August. The records described so far are directory-style information: names, contacts, titles, and assignments. No outlet reporting on the leak has described passwords or Social Security numbers in the set.
Two very different readings
Distributed Denial of Secrets co-founder Emma Best said a searchable tool built for the data would "replace anonymity with accountability" and help journalists, public records requests, and congressional oversight. The Department of Peace, in a statement included with the data, said department employees "have our information, so it's only fair that we have theirs" and hoped the data "can be used to limit further harm by the DHS."
Ryan Ottignon, a journalist who helped build the searchable database, rejected the suggestion that the release amounts to doxing government employees. He told NPR that agents who operate in cities while hiding their identities should face public oversight.
The department took a different view of the risk. In a statement to NPR, it said it was "aware of a potential breach and is actively working to address the situation swiftly and effectively" and taking steps to "ensure all are properly protected." The statement did not address how the data left the department.
The third leak in a month
The disclosure is the third major government data leak to surface in about a month, Reuters reported. In September, the hacking group ShinyHunters claimed the theft of FBI personnel data, including job details and medical information. Last week, the Defense Department faced a class action lawsuit after a breach exposed data on millions of current and former military personnel.
The Department of Peace had targeted the department before. In March, it claimed responsibility for hacking DHS and posting documents related to contracts with outside vendors.
For now, the central questions are unanswered: how the records left the department, whether the full set is authentic, and what happens to the people named in it. The department has not said whether it will notify employees individually, and no arrests or charges connected to the leak have been announced.
