A threat actor has leaked online a database containing the personal and work information of thousands of US Department of Homeland Security employees.
The hacker, who uses the handle Department of Peace, has leaked more than 41,000 records. “They have our information, so it’s only fair that we have theirs,” the hacker wrote in a note.
According to the hacker, the data was stolen from an Okta single sign-on system used by DHS employees and contractors to access its central environment.
“We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised,” an Okta spokesperson told SecurityWeek.
Most of the leaked records reportedly contain information on US Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), and Homeland Security Investigations (HSI) employees.
Roughly 1,000 CISA employees, along with personnel at several other DHS agencies, had their information leaked as well.
The compromised data includes names, work email addresses and phone numbers, job titles, and office locations, as well as records showing which systems and internal applications each account can access. An online tool to search the data is also available.
“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available,” a DHS spokesperson told SecurityWeek.
According to Distributed Denial of Secrets, which obtained a copy of the database and calls it ‘Icepick’, the leaked information identifies officials in charge of covert and undercover operations and key personnel in DHS’s rendition and deportation programs.
“The most concerning part of this breach is the access information that came with it. If an attacker knows which employees have access to which systems and applications, they’ve essentially been handed a roadmap for where to go next and who to target to get there,” said Illumio public sector CTO Gary Barlet.
The incident surfaced one month after the infamous extortion group ShinyHunters breached FBI systems, and three months after the Homeland Security Information Network (HSIN) was hacked.
*Updated with statement from DHS.
Related: Pentagon Personnel Agency Data Breach Impacts 3 Million People
Related: HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
Related: One Compromised Login Exposed Millions of California Students’ Records
Related: Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court System
