US Homeland Security Tries to Get Leaked Staff Data Removed From Icelandic Hosting Firm

The US Department of Homeland Security (DHS) on Thursday asked Icelandic hosting company FlokiNET to remove or limit access to a database containing information on thousands of department personnel. According to the request, which FlokiNET posted online, the database puts more than 40,000 identifiable individuals at risk of harassment, stalking and physical harm.

The request and the response

The email was sent to FlokiNET by ZeroFox, a company authorized by US Immigration and Customs Enforcement (ICE) to pursue content removal actions. ZeroFox was the source of the 40,000 figure.

FlokiNET chief executive Kolja Weber told Reuters his company would not remove the data. He explained that it contains government employees' work addresses and work phone numbers rather than personal phone numbers and addresses.

A DHS spokesperson said the department is aware of a potential breach and is actively working to address it swiftly and effectively. The spokesperson added that the agency takes all security threats against its employees and officers seriously.

How the data was released

DDoSecrets, a non-profit data transparency group, published data on more than 40,000 DHS personnel on its website on Wednesday. It was accompanied by a separate searchable database built by hacker and journalist "maia arson crimew". The database was briefly inaccessible on Thursday but was soon republished at a different domain.

A group calling itself "the Department of Peace" claimed responsibility for obtaining the data. In a statement on Wednesday, it said DHS employees have the group's information, so it is only fair that it has theirs. The group said it hoped the data could be used to limit further harm by DHS.

Background

Privacy advocates have previously criticized DHS for using personal data from other agencies, including Medicaid records and taxpayer data, for immigration enforcement.