Hacker steals records of 41,000 DHS employees via Okta

The US Department of Homeland Security (DHS) has suffered a major data breach. According to reports, a hacker obtained the personal and professional details of more than 41,000 employees across the department. The leaked data includes names, job titles, phone numbers, email addresses and office locations.

The breach is not limited to contact details. The data is also said to link certain DHS units to specific surveillance tools, which makes the incident more sensitive than an ordinary staff-list leak. Those affected include personnel at agencies such as ICE and CBP, which carry out immigration enforcement and border security.

Access gained through Okta

According to the accounts, the attack was carried out by a hacker calling themselves "Department of Peace." Access to the data was gained through Okta, the identity and access management service DHS uses. Okta is a service organizations rely on to manage employee accounts and logins to their systems.

About 21,000 of the records belong to Customs and Border Protection (CBP) employees and roughly 7,000 to Immigration and Customs Enforcement (ICE) personnel. The dataset also contains records from the Cybersecurity and Infrastructure Security Agency (CISA), US Citizenship and Immigration Services (USCIS) and Homeland Security Investigations (HSI). The breach therefore appears to have hit many different agencies under the DHS umbrella at once.

Clues about surveillance tools

One striking aspect of the leak is that, according to reports, it contains information about some DHS groups' access to tools that can be used for surveillance. These reportedly include Mobile Fortify, a facial recognition app, and PenLink, which can collect and analyze data from phones and online services. In other words, the data raises questions not only about who works where, but also about which groups can reach which tools.

DHS is reported to have gone to lengths to conceal the identities of CBP and ICE agents carrying out anti-immigration raids across the country, while also monitoring critics online. The attacker summed up their motive briefly: since they have our information, it is only fair that we have theirs. The remark suggests the leak was driven by a reaction to the department's secrecy and tracking practices.

Data now available through DDoSecrets

The stolen information was reportedly passed to security researcher maia arson crimew, who shared it with the nonprofit Distributed Denial of Secrets (DDoSecrets). The organization is now hosting the dataset, which has been dubbed "Icepick." That means the data is no longer solely in the attacker's hands but is publicly accessible.

The incident follows another breach a few weeks ago, in which hackers stole data on FBI employees and job applicants. Two such events in quick succession reinforce the impression that US federal agencies are struggling to protect sensitive personnel data. DHS did not immediately respond to a request for comment, and any statements from the department could clarify the true scale of the breach and the measures being taken.