A hacker stole more than 41,000 DHS employee records

A hacker stole personal information from the Department of Homeland Security, exposing names, job titles, phone numbers, email addresses, and office locations for more than 41,000 employees, including staff at ICE and CBP, according to TechCrunch and Wired. The data also linked the agencies to specific surveillance tools. The breach comes weeks after hackers stole data from the FBI on its employees and job applicants.

How the breach happened

A hacker known as "Department of Peace" gained access through Okta, an identity and access management service used by DHS, according to TechCrunch. Around 21,000 records pertain to CBP employees, and nearly 7,000 belong to staff at ICE, while Wired puts the ICE figure at about 10,000. The data also includes records from CISA, USCIS, and HSI. Okta said in a statement that it is "secure" and that it has "no evidence our data or systems were compromised."

What the leaked data includes

The leaked information was reportedly given to cybersecurity researcher maia arson crimew, who shared it with Distributed Denial of Secrets, a nonprofit organization now hosting the leaked "Icepick" dataset. The leak also reportedly includes information about DHS groups that have access to tools that can be used for surveillance, such as the facial recognition app Mobile Fortify and PenLink, which can collect and analyze data from phones and online services.

DHS response and context

The DHS has worked to conceal the identities of CBP and ICE agents, who have carried out anti-immigration raids around the US, while also tracking down online critics. "They have our information, so it's only fair that we have theirs," the "Department of Peace" hacker said, according to TechCrunch. The DHS did not immediately respond to The Verge's request for comment.

Sources: The Verge · Wired · TechCrunch · Reuters