DataBreachesDissent
DHS personnel leak exposes details of more than 41,000 staff
Part of the Silent Chollima story · since 27 Feb
- Fri 27 Feb, 10:22 UTC. SOCRadar, first report. North Korea linked Andariel shifts to espionage and ransomware.
- Thu 7 May, 23:25 UTC. dti.domaintools.com, its first report on the story. Fake Google Authenticator Chrome Extension Hits 260k Users.
- Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
- Thu 29 Oct, 13:30 UTC. Ars Technica, its first report on the story. Leak exposes 41,000 DHS workers, including undercover ICE agents.
- Thu 29 Oct, 15:31 UTC. SecurityWeek, its first report on the story. DHS Employee Data Leak Exposes Records of 41,000 People.
- Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
- Thu 29 Oct, 20:31 UTC. DataBreaches, its first report on the story. DHS personnel leak exposes details of more than 41,000 staff. This article, 7th of 7.
More than 41,000 current and former Department of Homeland Security personnel and contractors have had their contact details and sensitive role information exposed after a data leak, according to the release cited by Dissent on DataBreaches[.]net.
The data, obtained by the transparency group Distributed Denial of Secrets (DDoSecrets) from what the group calls Department of Peace, includes names, phone numbers, email addresses, job titles and internal group memberships across DHS components such as Immigration and Customs Enforcement, Customs and Border Protection, and the Cybersecurity and Infrastructure Security Agency, as well as other offices. Some entries describe roles involving surveillance, computer forensics and undercover work.
Nextgov/FCW corroborated portions of the data, including an official’s work phone number that the story’s reporter had independently obtained beforehand. Checks on several other listed numbers pointed to AT&T, described as providing communications services to DHS. LinkedIn profiles for several individuals named in the dataset also aligned with the listed job titles and positions.
The data’s provenance is alleged to involve an identity service used by DHS, with the leak attributed to the hacktivist collective Department of Peace; Maia arson crimew said on X that she was not involved in procuring the data and described her role as journalist conducting source work and data verification. The NextGov article linked in the report provides some corroboration of specific items within the dataset.
How the story developed
7 articles from 7 outlets since 27 Feb. Picked up again today after 7 weeks quiet. This was the 7th report, 244 days after the first.
- Fri 27 Feb, 10:22 UTC. SOCRadar, first report. North Korea linked Andariel shifts to espionage and ransomware.
- Thu 7 May, 23:25 UTC. dti.domaintools.com, its first report on the story. Fake Google Authenticator Chrome Extension Hits 260k Users.
- Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
- Thu 29 Oct, 13:30 UTC. Ars Technica, its first report on the story. Leak exposes 41,000 DHS workers, including undercover ICE agents.
- Thu 29 Oct, 15:31 UTC. SecurityWeek, its first report on the story. DHS Employee Data Leak Exposes Records of 41,000 People.
- Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
- Thu 29 Oct, 20:31 UTC. DataBreaches, its first report on the story. DHS personnel leak exposes details of more than 41,000 staff. This article, 7th of 7.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Fri 27 FebDay 01
- North Korea linked Andariel shifts to espionage and ransomware10:22 · SOCRadar · First report
Quiet for 10 weeks
Thu 7 MayDay 691- Fake Google Authenticator Chrome Extension Hits 260k Users23:25 · dti.domaintools.com · Picked up again
Quiet for 18 weeks
Mon 7 SepDay 1921- Researchers Map Lazarus Into Six North Korean Cyber Units11:26 · Infosecurity · Picked up again
Quiet for 7 weeks
Thu 29 OctDay 2444- Leak exposes 41,000 DHS workers, including undercover ICE agents13:30 · Ars Technica · Picked up again
- DHS Employee Data Leak Exposes Records of 41,000 People15:31 · SecurityWeek
- Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft
- DHS personnel leak exposes details of more than 41,000 staff20:31 · DataBreaches · This article, 7th of 7