WASHINGTON – A hacker group said that it cracked a Department of Homeland Security log-in system and exposed the names, phone numbers and office addresses of thousands of DHS personnel, including some involved in undercover immigration enforcement operations.
Calling itself the Department of Peace, the group said the leak is in response to ramped-up Immigration and Customs Enforcement operations. The leak follows other recent breaches of U.S. security information, including one in which an unrelated group of hackers known as ShinyHunters said it had stolen personal information about potentially tens of thousands of FBI employees and their families.
“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,”
the agency said in an Oct. 29 statement sent to USA TODAY. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”
DHS did not respond to a request for comment about its efforts to investigate the leak and prevent more.
The leak, reported by WIRED on Oct. 28, appears to be significant, exposing details of more than 40,000 employees or contractors who worked for DHS and its seven component agencies as of Aug. 19, including ICE and Customs and Border Protection.
It also references internal systems and sensitive information on undercover and surveillance programs, providing a roadmap of DHS’s organization and operations, including wiretap programs and the use of Palantir software and AI chatbots, WIRED reported.
How did the suspected breach come about?
The transparency nonprofit Distributed Denial of Secrets said the data was obtained by a “hacktivist” group known as the Department of Peace, which then provided it to Distributed Denial of Secrets and a journalist who goes by the name maia arson crimew. Those groups, in turn, previewed the data for WIRED.
Distributed Denial of Secrets published the data in an archive called “Icepick” on Oct. 28, and said it came from DHS’s Okta log-in system, revealing not only employee names, offices and contact information, but also at least some of their assignments.
Okta has disputed this, saying in a statement to Security Week: “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised.” OKTA spokesperson Jenny Grich had no further comment for USA TODAY.
Distributed Denial of Secrets, which says it “archives and publishes hacked and leaked documents in the public interest,” said it was posting an easily searchable database of the information built by crimew so the public could better understand what the various sub-agencies within DHS were doing.
Why did it happen?
The groups said they were releasing the information in response to the Trump administration’s lack of transparency and DHS Secretary Markwayne Mullin’s aggressive immigration enforcement and other efforts.
Since the start of the second Trump administration, agency officials have moved to hide DHS employees’ identities and activities, allowing street agents to wear masks, for instance, despite efforts by numerous states to prohibit that policy. The sprawling department, which employs more than 260,000 people, has also worked with the Justice Department to investigate its critics, including by using surveillance tools.
"On July 17th, Markwayne Mullin said he was 'turning up the heat.' This is what happens to ICE when you do that," a spokesperson for Department of Peace said in an online posting by Distributed Denial of Secrets.
Crimew, who identifies herself as both a journalist and a cyber security researcher, said the dataset is "massive in terms of both size and impact. It provides an unprecedented look into the Department of Homeland Security's organizational structure, highlighting which people do what work across multiple DHS agencies, including ICE."
"It is a complete game changer for anyone investigating DHS (and) provides FOIA material for years to come!" she added.
What kinds of information were leaked?
The release appears to contain work contact and organizational information only, not Social Security numbers or personnel files, according to a WIRED analysis of the data.
CBP staffers accounted for more than half of the records released. ICE accounts for 10,000, including about a third who work for ICE’s investigative wing, Homeland Security Investigations.
About 6,200 belong to U.S. Citizenship and Immigration Services, and nearly 1,000 are tied to the Cybersecurity and Infrastructure Security Agency. More than half of them are contractors, WIRED reported.
The database also appears to reference tools for accessing immigration court records, pulling data from seized phones and conducting surveillance.
Much of the data was organized around permission groups that DHS uses to control access to its internal systems, according to the leaked records.
At HSI, 39 employees across more than a dozen field offices belong to groups whose names include “CUC,” which government court filings say stands for “certified undercover operation,” WIRED reported, citing its analysis.
One such permission group, apparently based in HSI's St. Paul, Minnesota, area of operations, references "Keyhole," which federal court filings describe as a certified undercover operation that recently funded HSI’s undercover surveillance of Minneapolis protest groups earlier this year, WIRED reported.
Altogether, according to WIRED, the files reveal how DHS is structured, from senior leadership down to individual immigration agents and detention contractors.
Emma Best, a journalist and the cofounder of Distributed Denial of Secrets, said the Icepick database identifies many of the architects and drivers of DHS policy and operations, including “the officials responsible for overseeing covert and undercover operations, the government's hunt for leakers … along with key personnel in DHS's ever-escalating rendition and deportation programs."
This article originally appeared on USA TODAY: DHS probes massive leak exposing over 40,000 Homeland Security workers
