Hackers Expose Personal Data of 41,000 Homeland Security Workers

A hacktivist group known as the Department of Peace claims to have leaked identifying information for 41,000 employees of the U.S. Department of Homeland Security. The group stated that the breach exposed data for staff across several federal agencies, including Immigration and Customs Enforcement and U.S. Customs and Border Protection. The leak includes details for some undercover agents and contractors.

The Department of Peace said it accessed the records by subverting DHS’s Okta single sign-on system. In an online statement, a group spokesperson connected the breach to recent political tensions. The statement said that on July 17, Secretary Markwayne Mullin spoke about increasing pressure on ICE. The group added that because the government holds personal data on citizens, they felt entitled to hold the government's data in return.

The leak was coordinated with multiple outside parties before being made public. The Department of Peace sent the data to Distributed Denial of Secrets, a group that hosts a searchable database called Icepick. The hackers also shared the files with U.S. journalist Ryan Ottignon and a Swiss activist identified as maia arson crime. Ottignon and the Swiss activist worked to organize the raw data into a format that the public could search easily.

Wired analyzed the leaked files and found that more than 21,000 records belong to U.S. Customs and Border Protection staff. Another 10,000 records identify employees of ICE, with roughly a third of those belonging to the Homeland Security Investigations unit. Approximately 6,200 records are tied to U.S. Citizenship and Immigration Services. Nearly 1,000 records belong to the Cybersecurity and Infrastructure Security Agency, with more than half of those individuals listed as contractors.

The dataset covers about one-seventh of the department's total workforce of more than 220,000 people. The records reveal the internal structure of DHS, from senior leadership down to individual agents. They also show permission groups used to control access to internal systems. The data indicates that nearly everyone named in the leak had access to at least some internal tools.

The leak includes specific details about undercover operations. Within Homeland Security Investigations, 39 employees across more than a dozen field offices belong to groups labeled with the acronym CUC. Government court filings describe this as standing for certified undercover operation. Another group based in the St. Paul, Minnesota, area references a project called Keyhole. Federal filings describe Keyhole as an undercover operation that funded surveillance of Minneapolis protest groups earlier this year.

DHS released a statement acknowledging the potential breach. The department said it is actively working to address the situation swiftly. It added that it is taking necessary steps to ensure all personnel are properly protected. Alexander Leslie, a national security expert at Recorded Future, told Wired that the data is a valuable intelligence resource. He noted that an adversary could use the information to identify vulnerable personnel or impersonate staff to compromise ongoing investigations.