Data on 40,000 U.S. Homeland Security staff leaked

Personal and work contact data on more than 40,000 employees of the U.S. Department of Homeland Security has been published online, TechCrunch reported Oct. 28, in a breach that appears to have happened months ago and had not been disclosed.

The leaked records include names, job titles and work contact details such as email addresses, cell phone numbers and office locations, TechCrunch reported. CBC News and The Hill also reported on the leak, which covers border and immigration agents, cybersecurity staff and senior officials.

TechCrunch said the data amounts to about one-fifth of the department’s workforce of roughly 220,000 people. It said about 21,000 of the records belong to U.S. Customs and Border Protection staff and about 10,000 to Immigration and Customs Enforcement and its Homeland Security Investigations arm. Just under 1,000 are from the Cybersecurity and Infrastructure Security Agency, with the rest from headquarters, U.S. Citizenship and Immigration Services and the Federal Protective Service.

A hacker using the handle “Department of Peace” claimed to have taken the data from the Okta single sign-on system the department uses for employees and contractors, TechCrunch reported. The hacker did not respond to the outlet’s request for comment. In a note accompanying the data, the hacker said: “They have our information, so it’s only fair that we have theirs,” TechCrunch reported.

The records also include internal user groups showing which software and systems staff can access, according to TechCrunch. It said they reference a facial recognition app used by CBP and ICE, a web surveillance vendor and several commercial software products.

TechCrunch said the records appear to have been taken around mid-August, based on timestamps in the data. It said it verified a portion of the data as authentic by matching names against an offline copy of known DHS employees. The rest has not been independently confirmed, and the hacker’s claims about how the data was obtained are unverified.

An Okta spokesperson told TechCrunch: “Okta is secure, and we have no evidence our data or systems were compromised.” A DHS spokesperson did not immediately respond to the outlet’s request for comment, and it remained unclear whether the weakness that allowed the breach has been fixed, TechCrunch reported.

The data was passed to the nonprofit Distributed Denial of Secrets, which hosts leaked datasets that it considers to be in the public interest. Emma Best, a co-founder of the group, said the material will be a “catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests,” TechCrunch reported.

Ryan Shapiro, executive director of the transparency group Property of the People, said email addresses and phone numbers are “indispensable tools for FOIA researchers,” TechCrunch reported.

The leak adds to a run of breaches of U.S. government personnel data this year. TechCrunch said the same hacker claimed to have stolen thousands of DHS contracts in March, and it cited recent breaches affecting FBI and Pentagon personnel.

The story is developing, and no U.S. government confirmation of the breach had been published at the time of writing. Closer to home, Canadian organizations have had their own recent lapses, including the privacy commissioner’s probe of a Crime Stoppers data breach and the Loblaw data breach affecting 2 million customers. Separately, a U.S. court recently ruled ICE can detain people without bond hearings.

If you find reporting like this useful, consider supporting Canada News Media, an independent Canadian newsroom with no corporate parent.

Via TechCrunch, with reporting also from CBC News and The Hill. Original: TechCrunch.