The dump landed on Wednesday. Names, job titles, work emails, phone numbers, office addresses — records for more than 41,000 Department of Homeland Security employees and contractors. Distributed Denial of Secrets, a nonprofit that publishes leaked material, posted them.
It calls the database Icepick. DHS itself is in there, and so are seven component agencies.
WIRED saw the files before they went public and did the counting. Customs and Border Protection is the biggest chunk, roughly 21,000 records, more than half the total. ICE is next at about 10,000. Around a third of those sit in Homeland Security Investigations, ICE’s investigative wing. Citizenship and Immigration Services accounts for 6,200, and close to 1,000 records belong to the Cybersecurity and Infrastructure Security Agency.
None of this is fresh data, exactly. The files were last updated on Aug. 19, so whatever happened, happened about two months ago.
The contact details are only part of it. Attached to the records are more than 55,000 internal permission groups — the lists that say who can get into which systems. Read the group names and you get a rough map of sensitive work at the department: certified undercover operations, a Title III wiretap program, computer forensics. Some groups reference surveillance tools by name, among them Palantir’s Falcon platform, PenLink, which analyzes phone records and social media, and Mobile Fortify, a facial recognition app.
Where did it come from? DDoSecrets says a group calling itself the Department of Peace handed it over, and its press release says the records were taken from the Okta sign-on service DHS uses. Okta says no. “Okta is secure, and we have no evidence our data or systems were compromised,” a spokesperson told WIRED.
The hackers left a short note with the files:
“They have our information, so it’s only fair that we have theirs.”
The group said it hoped the data “can be used to limit further harm by the DHS and supports all efforts in that direction.”
Emma Best co-founded DDoSecrets. In a statement, she said the hacker and journalist maia arson crimew built a search tool so the public can go through the data, and that the tool would “replace anonymity with accountability,” helping journalists, records requests and congressional oversight along the way.
Nobody has verified the whole trove. Reuters tried a sample. It matched details for six employees against credit bureau records and breach data, then rang three of them. All three confirmed their numbers. One had not heard a word about any breach until Reuters called. CyberScoop, working separately, verified numerous current CISA employees in the data, along with some former leaders of the agency. Reuters could not check everything, and it could not back up the claim that the data came out of Okta.
DHS said nothing. Neither did the Justice Department. The FBI sent WIRED’s questions to DHS.
This is now the third big federal leak in a month, by Reuters’ count. In September, ShinyHunters said it had stolen a large batch of FBI material, job details and medical information for thousands of bureau staff included. Last week the Defense Department got sued over a breach involving millions of current and former military personnel.
Have something to promote?
Bring your business, services or event to our readers.