Hacktivists leak work details of 41,000 DHS staff; Okta disputes login claim
In brief
- DDoSecrets published work details of more than 41,000 DHS employees and contractors on Wednesday.
- Department of Peace, a self-described hacktivist group, supplied the records, the nonprofit said.
- Okta told Reuters it is secure and has no evidence its systems were compromised.
- DHS said it is aware of a potential breach; the search site went offline Thursday.
What's in the Icepick archive
DDoSecrets calls the dataset Icepick. According to Decrypt's report, the searchable archive indexes 41,191 people, including 21,329 from Customs and Border Protection and about 10,000 from ICE (a third of them in Homeland Security Investigations). It also lists more than 55,000 internal permission groups, along with each person's name, title, office, email, phone number and manager.
There aren't any home addresses in it, according to DDoSecrets co-founder Emma Best. The data isn't fresh, either. The newest records date to August 19, and some entries (including CISA staff who've since left the agency) are out of date.
The group says it acted after Homeland Security Secretary Markwayne Mullin pledged stepped-up ICE operations.
Okta pushes back as DHS moves on takedown
Okta, the company behind the login service, disputes the account. It told Reuters it's secure and that it has no evidence its data or systems were compromised, Decrypt reported.
DHS hasn't gone further than calling it a potential breach.
“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a department spokesperson said.
The department also filed a takedown notice through security firm ZeroFox, asking the domain registrar to stop serving contact and location data of people who didn't consent to publication, according to Decrypt. The search site built on the data stopped loading Thursday, with its domain showing a registrar hold. Bluesky is blocking links to the nonprofit hosting the archive.
Why the list cuts both ways
Transparency groups say the contact details are useful for public-records requests. Security researchers see a different risk. They warn the same list could help someone impersonate a supervisor over the phone or identify people working sensitive investigations.
It's also not the only recent claim aimed at federal staff. In September, the cybercrime group ShinyHunters claimed to hold 2 to 3 terabytes of data on FBI agents and job applicants, and the FBI told staff to assume their personal data was exposed.
