Hacktivists leak data of more than 41,000 US Homeland Security workers

Leaked personnel records raise fears of targeted attacks

Hacktivists have published personal and professional data on more than 41,000 US Homeland Security workers, raising concerns about targeted attacks.

Personal and professional information belonging to more than 41,000 employees and contractors at the US Department of Homeland Security (DHS) has been published online following a significant data breach.

The dataset includes names, phone numbers, email addresses, job titles and information about internal assignments across DHS agencies, including Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), Homeland Security Investigations and the Cybersecurity and Infrastructure Security Agency (CISA).

More than 21,000 of the records relate to CBP personnel, while around 6,600 relate to ICE, according to reporting on the leak.

Some of the information appears to identify personnel connected with surveillance, special operations, computer forensics and undercover work. The data also provides details of DHS's internal organisational structure and references previously undisclosed programmes or operations.

The information was published yesterday by transparency non-profit Distributed Denial of Secrets (DDoSecrets) which said it had received the records from a hacktivist group calling itself "Department of Peace".

DDoSecrets calls the dataset "Icepick" and describes it as a searchable internal database of more than 41,000 DHS employees. Icepick's searchability potentially makes it easy to identify personnel according to their names, offices, contact information and assignments.

DDoSecrets said that “this is not a comprehensive list of all DHS employees,” and quoted cofounder Emma Best saying, “Rather than an indiscriminate directory of every DHS employee, Icepick identifies many of the architects and drivers of DHS policy and operations.”

The group framed publication of the data as an attempt to increase scrutiny of DHS and of ICE (calling it Icepick isn't subtle) arguing that the disclosure could assist journalists, congressional inquiries and Freedom of Information Act requests.

Defining features of ICE include the fiercely protected anonymity of its masked agents and its use of facial recognition, profiling hacking and spyware tools. A note from the Department of Peace said;

“They have our information, so it’s only fair that we have theirs.”

DHS has meanwhile told the Washington Post that it is "aware of a potential breach" and is working to address the situation.

Source of leak contested

The source of the leaked information is unclear. Department of Peace said it had obtained the data from an Okta single sign-on service used by DHS.

However, when the leak was reported by WIRED, an Okta spokesperson denied a platform compromise: “Okta is secure, and we have no evidence our data or systems were compromised.”

The wording of the statement is as interesting for what is doesn’t say as much as what is does say. Whilst it is a clear denial that Okta has any evidence of its own systems and data being breached, it does not rule out compromise of DHS’s Okta tenant. It also does not rule out stolen credentials or a poorly secured integration at DHS – both of which have been the source of plenty of data breaches over the last two years.

Personal data matters

The incident highlights the risks created by personal data breaches – even when financial data isn’t compromised which many organisations seem to consider the benchmark of whether or not a breach is a problem – because it can provide useful reconnaissance for attackers seeking to conduct phishing or impersonation campaigns later.

Gary Barlet is Public Sector CTO at Illumio. He also happens to be a retired Air Force Cyber Operations Officer and served as the CIO for the Office of the Inspector General, US Postal Service. He said:

“We spend too much time treating identity as the finish line for security. Even when credentials or identity systems are involved, organizations have to assume an attacker will eventually get through the front door. The question is whether that access gives them the run of the place. That’s why limiting access and containing an attacker once they’re inside matters so much.

“The most concerning part of this breach is the access information that came with them. If an attacker knows which employees have access to which systems and applications, they’ve essentially been handed a roadmap for where to go next and who to target to get there.”