DHS Investigates Leak of Data on More Than 40,000 Employees After Takedown Bid Fails

WASHINGTON. The Department of Homeland Security said on Thursday that it is aware of a potential breach and is working to address it, after work contact and assignment details for more than 40,000 employees and contractors were published online. The agency said it takes security threats against its employees and officers seriously and will work to make sure they are protected.

The data was published on Wednesday by the nonprofit group Distributed Denial of Secrets in an archive called Icepick, alongside a searchable database built by hacker and journalist maia arson crimew, Reuters reported. A group calling itself the Department of Peace claimed responsibility for obtaining the data and said the release was a response to stepped-up Immigration and Customs Enforcement operations. USA Today reported that the leak was first reported by WIRED on October 28 and that the records covered people who worked for DHS and its seven component agencies as of August 19.

Reuters reported on Thursday that DHS, through a company authorized by ICE to pursue content removal, asked an Icelandic hosting company, FlokiNET, to take down or limit access to the data. The request said the database put more than 40,000 identifiable people at risk of harassment, stalking and physical harm. FlokiNET chief executive Kolja Weber told Reuters that his company would not remove the data because it contained government work addresses and work phone numbers, rather than personal phone numbers and addresses. Reuters reported that the database was briefly inaccessible on Thursday and was then republished at a different domain.

What the files contain

USA Today reported that the records included names, work email addresses, phone numbers, job titles and office locations, plus lists of the internal systems each account could open. According to a WIRED analysis cited by USA Today, the release appeared to contain work contact and organizational information only, rather than Social Security numbers or personnel files.

Customs and Border Protection staff accounted for more than half of the records, USA Today reported, citing WIRED. ICE accounted for 10,000 records, and about a third of those worked for Homeland Security Investigations. About 6,200 records belonged to U.S. Citizenship and Immigration Services, and nearly 1,000 were tied to the Cybersecurity and Infrastructure Security Agency. More than half of the people in the data were contractors, WIRED reported.

The files also pointed to internal tools and programs, according to WIRED. At Homeland Security Investigations, 39 employees across more than a dozen field offices belonged to permission groups whose names included CUC, which government court filings say stands for certified undercover operation. One such group, based in the St. Paul, Minnesota, area of operations, referred to Keyhole, which federal court filings describe as a certified undercover operation that recently funded undercover surveillance of protest groups in Minneapolis earlier this year, WIRED reported.

A takedown request and a disputed source

How the data was obtained remains disputed. Distributed Denial of Secrets said the data came from DHS’s Okta log-in system, which lets one log-in open many connected applications. Okta told SecurityWeek that Okta is secure and that it has no evidence its data or systems were compromised, USA Today reported.

DHS did not answer USA Today’s questions about its investigation or its efforts to stop further spread of the data. The agency said in its October 29 statement that it would update the public when more information is available. USA Today noted that the leak followed other recent breaches of U.S. security information, including a claim by a group known as ShinyHunters that it stole personal information about potentially tens of thousands of FBI employees and their families.

Reporting based on coverage by USA Today and Reuters.