Hacker cracks US Homeland Security and dumps 40,000 of its staff

A hacker going by Department of Peace has published personal data on more than 40,000 employees of the US Department of Homeland Security (DHS, the agency that runs border control, immigration enforcement and the country's cyber defense). TechCrunch reported the breach on October 28 after matching part of the records against known staff and concluding the dataset looks authentic.

The leak includes names, job titles, work emails, cell phone numbers and office locations. More than half of the records, about 21,000, belong to Customs and Border Protection (CBP), roughly 10,000 to Immigration and Customs Enforcement (ICE) and its investigations unit HSI, and just under 1,000 to the cybersecurity agency CISA. That is about a fifth of the department's entire workforce.

The worst part for the department is where the data came from. The hacker says it was pulled from the Okta single sign-on system that employees and contractors use to log into the department's central network. So the dump shows not just who works where, but which internal systems each person can reach: Microsoft 365, Citrix, Adobe Acrobat and user groups for Penlink, a surveillance tool that can track the location of mobile devices.

Timestamps suggest the data was taken around mid-August, and it is still unclear whether the hole has been closed or whether DHS even knows about it. Okta says its systems were not compromised. The data went to journalist and hacker maia arson crimew, who passed a copy to DDoSecrets, a nonprofit archive of leaked datasets. It is the second DHS breach this year claimed by the same hacker, who earlier took thousands of the department's contracts with private companies.

The verdict is simple: one login for everything is convenient for staff and even more convenient for whoever cracks it.