TechCrunch reports that personally identifiable information for more than 40,000 U.S. Department of Homeland Security employees was published online after a hacker stole files earlier this year. The incident marks a major Homeland Security data breach impacting border agents, cybersecurity staff, and senior officials.
Key takeaways
- A hacker known as Department of Peace leaked records for over 40,000 federal workers.
- The stolen information includes names, job titles, email addresses, cell phone numbers, and office locations.
- Data was allegedly obtained from an Okta single sign-on system used by the federal department.
- TechCrunch verified a portion of the data by matching names against an offline copy of the database.
What caused the Homeland Security data breach?
TechCrunch reports that a hacker going by the handle Department of Peace claims they took the data from an Okta single sign-on system. The department uses this setup to let employees and contractors log into its central network. The system also holds IT and login records, showing which internal apps workers can access.
More than half of the dataset, totaling roughly 21,000 records, involves employees with U.S. Customs and Border Protection. Another 10,000 records belong to Immigration and Customs Enforcement and its Homeland Security Investigations unit, alongside nearly 1,000 staff at CISA. Thousands more records cover staff at the department headquarters and agencies like U.S. Citizenship and Immigration Services.
What stolen government data reveals about internal tech
The leaked files provide a detailed view into digital tools used by the department. Records show membership in Active Directory user groups that control access to work tools. Most employees belonged to groups with access to Microsoft 365, Adobe Acrobat, and Citrix software.
The data also reveals that around 4,500 users belonged to a group linked to online therapy provider Headspace. Other user groups reference Penlink, a web surveillance company, and Mobile Fortify, a facial recognition app used by agents.
What happens next?
It remains unclear if the vulnerability that allowed the breach has been fixed, or if the department was aware of the theft before publication. TechCrunch verified part of the data as authentic by matching names against an offline database. Timestamps suggest the files were exfiltrated around mid-August. Representatives for Homeland Security did not immediately respond to requests for comment, while Okta stated it has no evidence its systems were compromised.
Frequently asked questions
The leaked files include names, job titles, work email addresses, cell phone numbers, and office locations for more than 40,000 Department of Homeland Security employees.
A hacker using the handle Department of Peace claimed responsibility for obtaining and publishing the stolen federal employee data online.
The hacker claimed the data was taken from an Okta single sign-on system used by the federal department to let staff log into its central network.
More than 40,000 people were affected, representing about one-fifth of the total workforce of the Department of Homeland Security.
Okta stated that it is aware of the report and maintains that its systems are secure, noting it has no evidence that its own data or systems were compromised.
Based on reporting by TechCrunch. Read the original article
