'Department of Peace' hackers leak data on 41,000 DHS employees via alleged Okta SSO access
A group calling itself the Department of Peace claims to have stolen and leaked personal and work details of more than 41,000 US Department of Homeland Security (DHS) employees. The data was passed to Swiss hacktivist maia arson crimew and published with DDoSecrets as "Icepick". DHS says it is aware of a potential breach. The group said it acted in response to a July 17 statement by DHS Secretary Markwayne Mullin, and had earlier claimed theft of DHS contract documents in March.
Detalhes técnicos
- Records span staff at nearly 7,000 offices: names, work emails, phone numbers, office addresses, job titles and internal Active Directory group memberships.
- Affected: about 6,600 ICE employees, over 21,000 CBP employees, and CISA staff.
- Group memberships reveal over 200 CBP users with access to the facial recognition tool Mobile Fortify, plus groups referencing Penlink. Job titles reportedly identify agents in special operations, surveillance and undercover work (Guardian, per article).
- Timestamps suggest data was taken around mid-August (TechCrunch, per article).
- The group says access came via DHS's Okta single sign-on service. Okta says it has no evidence its systems were compromised, which leaves open abuse of a DHS account with stolen credentials.
- Reuters matched six employees' data to credit bureau and breach records; a separate searchable version may include data added through external research.
Remediação
- DHS employees should follow agency guidance and verify unexpected calls, emails and texts through trusted channels.
- Never share passwords or MFA codes; change reused personal passwords and enable MFA.
- Report suspicious contact or threats to agency security, and contact law enforcement if in immediate danger.
Linha do tempo
-
'Department of Peace' hackers leak data on 41,000 DHS employees via alleged Okta SSO access
ler a análise desta fonte ocultar
A group calling itself the Department of Peace claims to have stolen and leaked personal and work details of more than 41,000 US Department of Homeland Security (DHS) employees. The data was passed to Swiss hacktivist maia arson crimew and published with DDoSecrets as "Icepick". DHS says it is aware of a potential breach. The group said it acted in response to a July 17 statement by DHS Secretary Markwayne Mullin, and had earlier claimed theft of DHS contract documents in March.
Technical Details
- Records span staff at nearly 7,000 offices: names, work emails, phone numbers, office addresses, job titles and internal Active Directory group memberships.
- Affected: about 6,600 ICE employees, over 21,000 CBP employees, and CISA staff.
- Group memberships reveal over 200 CBP users with access to the facial recognition tool Mobile Fortify, plus groups referencing Penlink. Job titles reportedly identify agents in special operations, surveillance and undercover work (Guardian, per article).
- Timestamps suggest data was taken around mid-August (TechCrunch, per article).
- The group says access came via DHS's Okta single sign-on service. Okta says it has no evidence its systems were compromised, which leaves open abuse of a DHS account with stolen credentials.
- Reuters matched six employees' data to credit bureau and breach records; a separate searchable version may include data added through external research.
Remediation
- DHS employees should follow agency guidance and verify unexpected calls, emails and texts through trusted channels.
- Never share passwords or MFA codes; change reused personal passwords and enable MFA.
- Report suspicious contact or threats to agency security, and contact law enforcement if in immediate danger.