Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents

Personally identifiable accusation belonging to thousands of U.S. Department of Homeland Security employees has been published online aft a hacker stole reams of information successful a antecedently undisclosed breach astatine the authorities section earlier this year.

The breach includes names, occupation titles, and enactment interaction information, specified arsenic email addresses, compartment telephone numbers, and bureau locations, of much than 40,000 radical who enactment for the national department, including borderline and migration agents, cybersecurity staffers, and elder section officials.

A hacker who goes by the grip Department of Peace claimed they obtained the information from an Okta azygous sign-on strategy utilized by Homeland Security to let employees and contractors crossed its assorted agencies to log into its cardinal network. The Okta strategy besides contains IT and login records associated with the employees’ idiosyncratic account, including details astir which systems and interior apps they are permitted to access.

More than fractional of the dataset — immoderate 21,000 records — subordinate to employees with U.S. Customs and Border Protection (CBP), who enactment astatine airports and different ports of entry. 

The information besides contains records associated with different 10,000 employees of Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) unit, and conscionable nether a 1,000 employees who enactment astatine U.S. cybersecurity defence bureau CISA. 

Thousands of further records subordinate to unit who enactment astatine the department’s office and its different agencies, including U.S. Citizenship and Immigration Services and the Federal Protective Service.

“They person our information, truthful it’s lone just that we person theirs,” said Department of Peace successful a enactment near with the data, which TechCrunch has seen. The hacker did not respond to TechCrunch’s email requesting remark and with questions astir however the breach was carried out.

This is the latest information breach to deed the U.S. authorities successful caller months, pursuing earlier hacks involving the theft of thousands of FBI agents’ unit records and the idiosyncratic accusation of millions of serving and erstwhile subject work unit from the Pentagon’s quality resources unit. It’s besides the 2nd breach involving Homeland Security this year, aft the aforesaid hacker claimed to person taken thousands of contracts betwixt the section and the backstage sector, including defence contractors and surveillance vendors.

The latest batch of breached data, which appears authentic, offers a uncommon — albeit incomplete — presumption into the standard and operations of Homeland Security, whose deportations, arbitrary detentions, and killings of U.S. citizens nether its enactment person go a cardinal contented for voters up of the upcoming U.S. midterm elections.

The stolen Homeland Security information was provided to writer and hacker, maia arson crimew, who past shared a transcript with DDoSecrets, a nonprofit corporate that hosts leaked datasets successful the nationalist interest.

TechCrunch verified a information of the information arsenic authentic by matching the names of respective known Homeland Security employees against an offline transcript of the database. The thousands of worker directory records look to person been exfiltrated astir mid-August, according to the timestamps connected each person’s record. The fig of leaked records is equivalent to astir one-fifth of Homeland Security’s workforce, which totals around 220,000 staff.

It’s unclear whether the vulnerability that allowed the breach has been fixed oregon if Homeland Security is alert of the information theft. 

A spokesperson for Homeland Security did not instantly respond to TechCrunch’s petition for remark astir the breach.

When reached, Okta said it was alert of this report. “Okta is secure, and we person nary grounds our information oregon systems were compromised,” a spokesperson said.

While the leaked information includes identifiable accusation astir agents and officers, the dataset besides reveals more astir the surveillance technologies and cybersecurity tools that Homeland Security employees whitethorn beryllium capable to access. Critics person called for investigations into tech companies that fund oregon supply their technology to ICE. 

The leaked information contains accusation astir employees’ rank successful idiosyncratic groups wrong the department’s Active Directory, a strategy that controls entree to the department’s interior tools, services, and third-party offerings utilized for work. 

Most of the Homeland Security employees successful the dataset were members of the idiosyncratic radical that had entree to Microsoft 365, the tech giant’s unreality work that hosts the agency’s emails and files, arsenic good arsenic idiosyncratic groups for accessing Adobe Acrobat, Citrix, and different emblematic desktop software.

The information besides shows that astir 4,500 users, including ICE agents and deportation officers, are members of a radical called “Headspace_users.” Online therapy supplier Headspace antecedently had an $82,500 national declaration with ICE that ended successful 2023 to money “mental wellness bundle required for ERO employees,” a notation to ICE’s deportation unit. 

A spokesperson for Headspace said the institution has not provided immoderate services to DHS oregon ICE since 2023.

Dozens of different idiosyncratic groups notation Penlink, a web surveillance institution that makes exertion it claims tin way the determination information of hundreds of millions of mobile devices.” Penlink has had a contract with ICE for years. The idiosyncratic groups alteration successful size, from a fistful of users successful section Homeland Security offices astir the state to much than 2,000 users crossed ICE’s HSI portion nationally. One radical specifically references Penlink PLX, which the institution says is utilized to seizure and analyse “real-time intelligence” from telephone calls, texts, web activity, and societal media. 

A spokesperson for Penlink did not respond to a petition for comment.

One idiosyncratic radical besides includes much than 200 CBP users associated with Mobile Fortify, a facial designation app utilized by some CBP and ICE agents to identify radical and verify their accusation and migration status.

The idiosyncratic groups besides see respective employees associated with ChatGPT access, including elder DHS officials, arsenic good arsenic different groups associated with investigations into the China-backed hacking groups known arsenic Salt Typhoon and Volt Typhoon.

Researchers and nationalist accusation advocates accidental that the exposed information could supply invaluable leads for investigations into alleged abuses by the Trump administration, specified arsenic identifying email addresses of agents that tin beryllium utilized successful nationalist records requests nether the Freedom of Information Act.

“Email addresses and telephone numbers are indispensable tools for FOIA researchers, often making the quality betwixt a vague records petition that gets stonewalled and 1 that gets results,” said Ryan Shapiro, the enforcement manager of transparency nonprofit Property of the People. 

“Given the Trump administration’s contempt for adjacent basal transparency, the request for specified tools is urgent,” said Shapiro.

DDoSecrets co-founder and writer Emma Best said that the exposed Homeland Security information volition beryllium a “catalyst for investigations, empowering journalists, Congressional inquiries, ineligible challenges, assemblage enactment and Freedom of Information Act requests.”