The US Department of Homeland Security (DHS) is investigating a data breach affecting more than 41,000 employees and contractors. The leaked files contain, among others, email addresses, telephone numbers, workplaces and professional information, with elements linked to surveillance activities or covert operations.
More than 21,000 entries are believed to be associated with US Customs and Border Protection (CBP), while several thousand are linked to Immigration and Customs Enforcement (ICE) and Homeland Security Investigations. The leak thus exposes an important part of the DHS workforce.
Okta cited as hotspot
The hacktivist group Department of Peace claims to have recovered this information through the Okta single sign-on system used by DHS. However, this origin is not confirmed. Okta says it has found no evidence that its own systems are compromised. The digital identity specialist had already faced several security incidents.
The data was then transmitted to Distributed Denial of Secrets, who named the set Icepick. The database would also reveal certain internal structures and links to sensitive programs, posing additional risks to affected personnel.
DHS promises to protect its agents
DHS says “aware of possible infringement” and claims to be working to quickly resolve the situation. The administration assures that it is necessary “all security threats seriously directed at its employees and agents.” Public administrations continue to be common targets, as recently demonstrated by leaks affecting ANSSI and DINUM in France.
Beyond the number of people exposed, the nature of the information published is worrying: professional contact details, organizational charts and links to sensitive missions can facilitate targeted phishing, identity theft or direct pressure against certain agents.
