Hacker leaks personnel data of over 40,000 US Homeland Security employees
Data on more than 40,000 employees of the US Department of Homeland Security, including border and immigration agents, has been published online. A hacker calling themselves Department of Peace stole it earlier this year.
Personal data on more than 40,000 employees of the US Department of Homeland Security, the federal agency responsible for border control, immigration enforcement and cybersecurity, has been published online following a previously undisclosed breach earlier this year. The hacker, who uses the handle Department of Peace, took names, job titles and work contact details, including email addresses, cell phone numbers and office locations. The records cover border and immigration agents, cybersecurity staff and senior officials.
How the data was obtained
The hacker claims the information came from an Okta single sign-on system, which employees and contractors use to log into the department's central network. The system also holds IT and login records, including details of which systems and internal apps each person can access. Timestamps on the records suggest the data was taken around mid-August.
About 21,000 records relate to U.S. Customs and Border Protection (CBP) employees and another 10,000 to Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) unit. Just under 1,000 relate to CISA, the U.S. cybersecurity defense agency. The total is roughly one-fifth of the department's workforce of around 220,000.
What user groups show
The data also shows which tools staff can reach. About 4,500 users, including ICE agents, belong to a group named "Headspace_users"; Headspace, an online therapy provider, had an ICE contract that ended in 2023, and the company says it has provided no services to the department since. Several groups reference web surveillance company Penlink, and more than 200 CBP users are linked to Mobile Fortify, a facial recognition app.
Reactions
Okta said it has no evidence its systems were compromised. The department did not immediately comment, and it is unclear whether the vulnerability has been fixed. Researchers note that the email addresses could help in filing Freedom of Information Act requests.
