By Salma El-Sakka
A leak website has published personal information on more than 40,000 Department of Homeland Security employees, including officials working in sensitive fields such as surveillance and human intelligence. Distributed Denial of Secrets, a nonprofit data transparency group, announced the release on Wednesday.
Leak Details
The data includes names, phone numbers and email addresses of employees from Immigration and Customs Enforcement, Customs and Border Protection, Homeland Security Investigations, the Cybersecurity and Infrastructure Security Agency, and other DHS component agencies. Job titles and email groups were also included, revealing which agents were assigned to special operations, surveillance jobs, computer forensics and undercover work.
Government Response
DHS said in a statement it was "aware of a potential breach and is actively working to address the situation swiftly and effectively." The agency said it was working to ensure its employees were properly protected and would update the public "when more information is available."
Recent Breach Pattern
This is the third major government data leak to make headlines in the past month. In September, the hacking group ShinyHunters claimed to have stolen a massive trove of data from the Federal Bureau of Investigation, including sensitive job details and medical information from thousands of bureau employees. Last week, the Defense Department was hit with a class action lawsuit following a breach that exposed data on millions of current and former military personnel.
Hacktivist Tool
Distributed Denial of Secrets co-founder Emma Best said the hacktivist and journalist known as "maia arson crimew" developed a search tool for the data that would allow the public to browse it. Best said the tool would "replace anonymity with accountability" and empower journalists, guide public records requests and boost congressional oversight.
Data Source Claims
The group says the disclosure draws on information obtained by an entity calling itself "Department of Peace." That entity claimed responsibility in March for hacking DHS and posting documents related to contracts with outside vendors. Best's statement said the Department of Peace harvested the data from the Okta sign-on service used by DHS. Okta responded that its systems are secure and it has no evidence its data or systems were compromised. Reuters verified some of the leaked information by matching it to credit bureau records and contacting several DHS employees.
