DHS’s 41,000-person contact list turns into an icy data leak

A transparency nonprofit published personal information belonging to more than 41,000 Department of Homeland Security employees and contractors, including names, job titles, office locations, email addresses, phone numbers and managers, according to a report published Wednesday.

Distributed Denial of Secrets said a hacktivist group calling itself the Department of Peace supplied the records, which the nonprofit named Icepick. The searchable archive includes 41,191 people, with 21,329 from Customs and Border Protection and about 10,000 from Immigration and Customs Enforcement, including roughly a third from Homeland Security Investigations. It also contains more than 55,000 internal permission groups that determine access to systems, but the nonprofit said no home addresses were included.

The Department of Peace said it obtained the information from an Okta single sign-on service used by DHS. Okta disputes that claim. “Okta is secure, and we have no evidence our data or systems were compromised,” the company told Reuters. The group said it acted after Homeland Security Secretary Markwayne Mullin pledged stepped-up operations by ICE. “On July 17th, Markwayne Mullin said he was ‘turning up the heat.’ This is what happens to ICE when you do that,” a spokesperson for the group said. “They have our information, so it’s only fair that we have theirs,” the hackers wrote.

DHS spokesperson said, “DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively.” The department also filed a takedown notice through ZeroFox, asking the domain registrar to stop serving contact and location data belonging to people who did not consent to its publication, and the searchable site stopped loading Thursday.

Separately, the FBI has instructed employees to treat their personal information as potentially stolen after a claimed breach of FBIjobs.gov, according to an internal memo reported by Reuters. The cybercriminal group ShinyHunters claimed it held data on nearly all FBI agents and job applicants, estimating the haul at 2 to 3 terabytes.