Skip to content
OriginalSign in
Image: Malwarebytes

Malwarebytes

Hackers publish personal data on 41,000 DHS workers

Part of the Silent Chollima story · since 27 Feb

Developinglatest 2 hours ago8 articles8 outlets
27 Feb · SOCRadar first1 Jul12 Aug23 SepNowThis article8th of 8
  • Fri 27 Feb, 10:22 UTC. SOCRadar, first report. North Korea linked Andariel shifts to espionage and ransomware.
  • Thu 7 May, 23:25 UTC. dti.domaintools.com, its first report on the story. Fake Google Authenticator Chrome Extension Hits 260k Users.
  • Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Thu 29 Oct, 13:30 UTC. Ars Technica, its first report on the story. Leak exposes 41,000 DHS workers, including undercover ICE agents.
  • Thu 29 Oct, 15:31 UTC. SecurityWeek, its first report on the story. DHS Employee Data Leak Exposes Records of 41,000 People.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Thu 29 Oct, 20:31 UTC. DataBreaches, its first report on the story. DHS personnel leak exposes details of more than 41,000 staff.
  • Fri 30 Oct, 12:30 UTC. Malwarebytes, its first report on the story. Hackers publish personal data on 41,000 DHS workers. This article, 8th of 8.

A group calling itself the Department of Peace says it stole and published personal details for more than 41,000 staff working for the US Department of Homeland Security (DHS). The data, described by the publishers as “Icepick,” spans almost 7,000 DHS offices and includes names, work email addresses, phone numbers, office addresses, job titles and membership in internal DHS groups.

The affected workforce comprises almost 6,600 employees from Immigration and Customs Enforcement (ICE), over 21,000 from Customs and Border Protection (CBP), and personnel at the Cybersecurity and Infrastructure Security Agency (CISA). The data dump is alleged to facilitate targeted scams, harassment, stalking or physical threats, with Reuters noting cross-referencing of several records to credit bureau data and a dark web intelligence platform.

The dataset also contains information about membership in groups within Active Directory, including access to tools such as a facial recognition service and location-tracking capabilities.

The attackers claimed to accessed the data via a single sign-on service provided by Okta, and DHS says it is aware of a potential breach. Okta says there is no evidence its own systems were compromised, though that does not rule out abuse of DHS accounts with stolen credentials. The data published by the group was provided to Swiss hacktivist maia arson crimew and released in collaboration with DDoSecrets, which has previously published other leak dumps.

DHS guidance emphasises caution against unexpected contact and to report threats, while the exposed records could enable attackers to craft convincing phishing or impersonation attempts against DHS staff.

How the story developed

All 8 articles
Developinglatest 2 hours ago8 articles8 outlets

8 articles from 8 outlets since 27 Feb. Picked up again on 29 Oct after 7 weeks quiet. This was the 8th report, 245 days after the first.

Now27 Feb6 May105 Sep9First reportSOCRadar · 27 Feb, 10:22This article8th of 8 · day 245Picked up againafter 10 weeks quiet
  • Fri 27 Feb, 10:22 UTC. SOCRadar, first report. North Korea linked Andariel shifts to espionage and ransomware.
  • Thu 7 May, 23:25 UTC. dti.domaintools.com, its first report on the story. Fake Google Authenticator Chrome Extension Hits 260k Users.
  • Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Thu 29 Oct, 13:30 UTC. Ars Technica, its first report on the story. Leak exposes 41,000 DHS workers, including undercover ICE agents.
  • Thu 29 Oct, 15:31 UTC. SecurityWeek, its first report on the story. DHS Employee Data Leak Exposes Records of 41,000 People.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Thu 29 Oct, 20:31 UTC. DataBreaches, its first report on the story. DHS personnel leak exposes details of more than 41,000 staff.
  • Fri 30 Oct, 12:30 UTC. Malwarebytes, its first report on the story. Hackers publish personal data on 41,000 DHS workers. This article, 8th of 8.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Fri 27 FebDay 01
    1. North Korea linked Andariel shifts to espionage and ransomware10:22 · SOCRadar · First report

  2. Quiet for 10 weeks

    Thu 7 MayDay 691
    1. Fake Google Authenticator Chrome Extension Hits 260k Users23:25 · dti.domaintools.com · Picked up again

  3. Quiet for 18 weeks

    Mon 7 SepDay 1921
    1. Researchers Map Lazarus Into Six North Korean Cyber Units11:26 · Infosecurity · Picked up again

  4. Quiet for 7 weeks

    Thu 29 OctDay 2444
    1. Leak exposes 41,000 DHS workers, including undercover ICE agents13:30 · Ars Technica · Picked up again
    2. DHS Employee Data Leak Exposes Records of 41,000 People15:31 · SecurityWeek
    3. Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft
    4. DHS personnel leak exposes details of more than 41,000 staff20:31 · DataBreaches
  5. Fri 30 OctDay 2451
    1. Hackers publish personal data on 41,000 DHS workers12:30 · Malwarebytes · This article, 8th of 8

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in