Key takeaways
- TechCrunch counted about 21,000 CBP employees and about 10,000 ICE and HSI staff among the more than 40,000 people named in the files.
- The records include work emails, cell numbers, office locations and internal group memberships, including groups tied to undercover agents and surveillance tools.
- Okta says it has no evidence its data or systems were compromised, and DHS told the BBC it is working to address a potential breach.
In this story 4 sections
More than 40,000 people who work for the Department of Homeland Security now have their names, job titles and work phone numbers sitting in a searchable public database. The DHS data leak, published on October 28 by the transparency group Distributed Denial of Secrets (DDoSecrets), covers roughly one in five of the department's approximately 220,000 staff, according to TechCrunch. Most of the people named work at the two agencies driving the administration's immigration push: Customs and Border Protection and Immigration and Customs Enforcement.
DHS has not confirmed where the records came from. The hacker behind it says they were pulled from the Okta login system DHS uses for employees and contractors, and Okta says its own systems were not breached.
Over 21,000 CBP staff and thousands at ICE in the Icepick files
DDoSecrets calls the dataset "Icepick." A search site built by the Swiss hacker and journalist maia arson crimew with journalist Ryan Fae, icepi.cx, indexes 41,191 people and 55,603 internal groups, Help Net Security reported.
The agency counts differ slightly by outlet. TechCrunch counted about 21,000 CBP employees, about 10,000 at ICE including Homeland Security Investigations (HSI), just under 1,000 at the Cybersecurity and Infrastructure Security Agency, and thousands more at DHS headquarters, U.S. Citizenship and Immigration Services and the Federal Protective Service. Help Net Security put CBP at 21,329 and ICE at 6,598. The gap may come down to whether HSI staff are counted under ICE.
According to TechCrunch, the records include:
- Full names and job titles
- Work email addresses, cell phone numbers and office locations
- Login and IT records showing which internal systems and apps each person can reach
- Membership in internal groups
Those group names are where the leak gets sensitive. Help Net Security said the files list operation names, groups for HSI certified undercover agents, groups that grant access to digital forensics tools, and ICE use of force instructors. TechCrunch found more than 200 CBP users in a group tied to the Mobile Fortify facial recognition app, an HSI group with more than 2,000 members linked to Penlink surveillance tools, and about 4,500 users in a group called "Headspace_users."
A hacktivist called "Department of Peace" points to Okta
The person claiming the theft goes by "Department of Peace." TechCrunch reported that the hacker handed the data to crimew, who shared a copy with DDoSecrets. Timestamps in the files suggest the records were taken around mid August.
"They have our information, so it's only fair that we have theirs," the hacker wrote, according to TechCrunch. CyberScoop reported that the group tied the breach to DHS Secretary Markwayne Mullin's July 17 promise to step up ICE operations. TechCrunch said this is the second DHS breach this year linked to the same hacker, after a March claim involving stolen contract data.
Okta pushed back on the claimed source. "Okta is secure, and we have no evidence our data or systems were compromised," the company said in a statement quoted by both TechCrunch and CyberScoop. That leaves open whether the records came from a DHS account, a misconfigured connection or somewhere else entirely. None of the outlets had an answer on that as of Thursday.
Reuters reached employees who had not been told
TechCrunch said the data appears authentic but that it could verify only part of it. Reuters went further, according to Help Net Security: it matched six named DHS employees against credit bureau and breach records and phoned three of them. One said it was the first they had heard of any breach.
DHS told the BBC it is "aware of a potential breach and is actively working to address the situation swiftly and effectively," Help Net Security reported, and said it would update the public. TechCrunch and CyberScoop both said the department did not immediately respond to their questions.
DDoSecrets co-founder Emma Best told TechCrunch the files could be a "catalyst for investigations," and CyberScoop reported she said the records identify officials who oversee covert operations and leak hunts. "This dataset is massive in terms of both size and impact," crimew told CyberScoop.
It is the latest in a string of large data exposures, after the ConnectWise breach Microsoft tied to Chinese hackers and the California student data breach at testing vendor ETS. More government security coverage is on our tech page.
Work phones and emails are now targets for phishing
A list of verified work emails and cell numbers, matched to job titles and system access, is exactly what phishing crews look for. Anyone named in the files, including contractors, should expect texts and calls that pretend to come from IT support, Okta or a supervisor, and should treat password reset links with suspicion.
If a message already got through, our guide on what to do after clicking a bad link walks through the first ten minutes, and this checklist on how to know if your phone is hacked covers the signs to watch for afterward.
The bigger unanswered question is how a single account or integration could expose the group memberships of 41,000 people. Until DHS explains that, it is hard to say whether the hole has been closed.
Share this story
Spotted an error? Tell us
