In brief
- Distributed Denial of Secrets published a dataset called Icepick on Oct. 28 with work details for 41,191 DHS employees and contractors, including 21,329 from Customs and Border Protection and about 10,000 from ICE.
- A hacktivist group called the Department of Peace says it took the records from an Okta login service used by DHS, while Okta says it has no evidence its systems were compromised.
- DHS says it is aware of a potential breach and has filed a takedown notice; a sample of named employees has been matched to other records but the full archive has not been verified.
Names, job titles, office locations, and phone numbers for more than 41,000 Department of Homeland Security employees and contractors were published online Wednesday by a transparency nonprofit.
The nonprofit says a hacktivist group, meaning hackers driven by politics rather than profit, gave it the records.
The department oversees border protection, immigration enforcement, and cybersecurity, so the file works like a directory of who does what, who reports to whom and how to reach them.
Transparency groups say the contact details are useful for public-records requests. Security researchers warn the same list could help anyone who wants to impersonate a supervisor over the phone or work out who sits behind a sensitive investigation.
The nonprofit, Distributed Denial of Secrets, publishes leaked documents and calls this dataset Icepick. It says the hackers, who call themselves the Department of Peace, took the records from an Okta single sign-on service used by DHS, a login system that lets employees open many internal tools with one account.
Okta, the company behind that login service, disputes the claim. “Okta is secure, and we have no evidence our data or systems were compromised,” the company told Reuters.
→The group says it acted after Homeland Security Secretary Markwayne Mullin pledged stepped-up operations by Immigration and Customs Enforcement, known as ICE. “On July 17th, Markwayne Mullin said he was ‘turning up the heat.’ This is what happens to ICE when you do that,” a spokesperson for the group said. “They have our information, so it’s only fair that we have theirs,” the hackers wrote.
The searchable archive indexes 41,191 people, including 21,329 from Customs and Border Protection and about 10,000 from ICE, a third of them in its investigative arm, Homeland Security Investigations.
It also lists more than 55,000 internal permission groups, which are labels that control who can open which systems, along with each person’s name, title, office, email, phone number and manager. DDoSecrets co-founder Emma Best says the dataset contains no home addresses.
“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a department spokesperson said.
DHS has also filed a takedown notice through the security firm ZeroFox, asking the domain registrar to stop serving contact and location data of people who did not consent to its publication. The search site built on the data stopped loading Thursday, with its domain showing a registrar hold, and Bluesky is blocking links to the nonprofit hosting the archive.
In September, the cybercrime group ShinyHunters claimed to hold 2 to 3 terabytes of data on FBI agents and job applicants, and the bureau told staff to assume hackers have their personal data.
The newest records in the archive date to August 19, and some entries, including CISA staff who have since left the agency, are already out of date.