DHS Employee Data Leak Exposes Records of 41,000 People

A security breach appears to have exposed the personal and work information of more than 41,000 US Department of Homeland Security (DHS) employees and contractors. The records were allegedly taken from an Okta single sign-on system used to access DHS’s central environment, according to a threat actor going by the name Department of Peace.

Okta has said there is no evidence that its data or systems were compromised, while DHS has acknowledged a potential breach and said it is working to address the situation and protect affected personnel.

The database, which is now searchable online, is reported to include details primarily related to the Department’s Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), and Homeland Security Investigations (HSI) staff, with around 1,000 California Information Sharing and Analysis Center (CISA) personnel among others also affected.

The compromised data reportedly comprises names, work email addresses, phone numbers, job titles, and office locations, plus records showing which systems and internal applications each account can access. Insights from the data indicate access permissions that could serve as a roadmap for attackers to target additional systems. The database has been circulated by Distributed Denial of Secrets, which refers to the dataset as Icepick.

DHS has pledged to protect personnel and provide updates as more information becomes available, while industry observers emphasise that access mappings in such breaches can magnify follow-on risk. The article notes the timing in relation to other recent DHS incidents and mentions statements from security researchers about the risk to operational targets. Data leaked by the group ShinyHunters and prior DHS breaches are referenced for context. The piece carries updates and the DHS comment.