Homeland Security employee records exposed in leak affecting more than 40,000

Personnel records for more than 40,000 US Department of Homeland Security workers and contractors have been published online, TechCrunch and WIRED reported on October 28. The exposed work contact details and references to internal systems could help identify staff and reveal parts of the department’s organization; the precise number of affected people is unclear.

TechCrunch reported more than 40,000 affected people, while WIRED described records for more than 41,000 employees or contractors across DHS and seven component agencies. The records include names, job titles, email addresses, phone numbers and office locations or addresses, as well as references to internal systems and access groups.

CBP and ICE account for much of the exposed data

The dataset includes IT and login records showing which systems and internal applications employees were permitted to access, TechCrunch reported. WIRED said some access-group names refer to undercover operations. Those references describe permissions and organizational information; they do not by themselves establish what any listed person did with that access.

How the DHS records surfaced

A hacker using the name Department of Peace claimed to have obtained the data from a DHS Okta sign-on system, TechCrunch reported. The account of how the data was taken remains the hacker’s claim. Okta told TechCrunch it had no evidence its own data or systems were compromised.

TechCrunch said it checked part of the dataset against the names of known DHS employees. It reported that record timestamps pointed to an extraction around mid-August. WIRED said the records were last updated on August 19 and that journalist and hacker maia arson crimew had made the dataset searchable on a website.

DHS had not responded to either outlet’s request for comment. TechCrunch said it was unclear whether the department knew of the theft or whether the vulnerability involved had been fixed. WIRED reported that the FBI referred its inquiry to DHS.

Alexander Leslie, a national security expert at Recorded Future, told WIRED that, if authentic and current, the dataset could be valuable to people trying to penetrate DHS, particularly when combined with other compromised information. The exposure follows a separate claimed theft of FBI employee and family information that WIRED described in its report.