Hacker Leaks Personal Data of Over 40,000 U.S. Homeland Security Employees

Image: TechCrunch · Source

A hacker breached an Okta system to steal personally identifiable information of 40,000+ Homeland Security workers, including CBP and ICE agents, revealing internal access details and sparking concerns over data security and surveillance use.

A significant cybersecurity breach has exposed sensitive personnel information of more than 40,000 employees affiliated with the U.S. Department of Homeland Security (DHS). The stolen data encompasses names, job titles, and work contact details such as email addresses, phone numbers, and office locations. Among those affected are agents from U.S. Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), cybersecurity staff from the Cybersecurity and Infrastructure Security Agency (CISA), as well as officials from other DHS branches.

The attacker, using the pseudonym Department of Peace, claimed to have acquired the data by exploiting vulnerabilities in an Okta single sign-on system utilized across DHS agencies for centralized network access. This compromised system also stores information about employees’ authorizations and login activities. The dataset comprises roughly 21,000 CBP employees, 10,000 ICE personnel associated with ICE’s Homeland Security Investigations unit, approximately 1,000 CISA workers, and thousands more from other DHS divisions.

This breach represents about one-fifth of DHS's overall workforce. The compromised data was timestamped around mid-August, but it remains unclear if the department has been made aware of the intrusion or if the vulnerability that allowed it has been remediated.

Okta has stated it has no evidence indicating that its systems were breached, emphasizing its platform's security integrity. DHS has yet to publicly comment on the incident.

Beyond personal details, the leak reveals which internal tools and third-party applications employees are authorized to access, including Microsoft 365, Adobe Acrobat, and Citrix software. Notably, records show around 4,500 users linked to a group named Headspace_users—reflective of ICE’s prior contract with the mental health provider Headspace, which ended in 2023.

The data also exposes associations with surveillance technologies, such as Penlink, a contractor offering capabilities to monitor mobile device location and capture real-time intelligence from communications and social media. This involvement raises scrutiny over the use of such technologies by immigration enforcement agencies.

Additional information connects over 200 CBP users to Mobile Fortify, a facial-recognition application employed for identity and immigration status verification in the field. Furthermore, groups related to ChatGPT access and investigations into China-backed hacking groups were identified within the dataset.

The leaked data was shared by journalist and hacker maia arson crimew with the nonprofit Distributed Denial of Secrets (DDoSecrets), which hosts leaked datasets for public interest investigations.

Advocates highlight that such exposed contact details could facilitate Freedom of Information Act (FOIA) requests and investigations into alleged misconduct by past DHS administrations, helping push for transparency in government practices. This breach follows a series of recent data leaks impacting U.S. government personnel, including prior incidents affecting FBI agents and Pentagon military records.

The full impact and response to this DHS personnel data leak continue to unfold as stakeholders assess the security and privacy implications.