The short version
- More than 41,000 DHS employee records were stolen, including names, phone numbers, and office locations for ICE and CBP agents.
- The breach exploited Okta, an identity management service, and included data linking agencies to surveillance tools like Mobile Fortify.
- The leak follows a recent FBI data theft, highlighting ongoing vulnerabilities in federal government cybersecurity infrastructure.
A significant data breach has exposed the personal information of more than 41,000 employees within the U.S. Department of Homeland Security (DHS). The stolen records include names, job titles, phone numbers, email addresses, and office locations for staff across multiple agencies. Among those affected are thousands of agents from U.S. Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP), whose identities the government has historically worked to protect.
The breach was carried out by a hacker group operating under the name 'Department of Peace.' According to reports, the attackers gained access to the sensitive data through Okta, an identity and access management service utilized by the DHS. The compromised dataset, referred to as 'Icepick,' includes approximately 21,000 records pertaining to CBP employees and nearly 7,000 belonging to ICE staff. Additional records from the Cybersecurity and Infrastructure Security Agency (CISA), U.S. Citizenship and Immigration Services (USCIS), and Homeland Security Investigations (HSI) were also included.
Beyond basic contact information, the leaked data reveals sensitive operational details. It links specific DHS groups to surveillance tools such as Mobile Fortify, a facial recognition application, and PenLink, a tool capable of collecting and analyzing data from phones and online services. This exposure raises concerns about the privacy of both government employees and the individuals they monitor, as well as the security of the technologies used in law enforcement operations.
The hacker group stated that the leak was motivated by a desire for reciprocity. 'They have our information, so it’s only fair that we have theirs,' the 'Department of Peace' group said, according to TechCrunch. The stolen data was reportedly handed over to cybersecurity researcher maia arson crimew, who then shared it with Distributed Denial of Secrets (DDoSecrets), a nonprofit organization now hosting the dataset.
This incident occurs in the context of growing concerns about federal government cybersecurity. It comes just weeks after hackers stole data from the FBI involving its employees and job applicants. The pattern of breaches targeting major law enforcement and intelligence agencies suggests persistent vulnerabilities in how sensitive personnel data is stored and protected across different branches of the U.S. government.
The DHS has not immediately responded to requests for comment regarding the breach. However, the exposure of agent identities poses potential safety risks, particularly for those involved in high-profile immigration enforcement actions. The agency has previously emphasized the importance of concealing the identities of CBP and ICE agents who conduct raids and track online critics, making this leak a significant security setback.
Social media platforms have begun responding to the spread of the leaked information. Bluesky, for instance, has started blocking links to the major leak of DHS employee records, attempting to limit the dissemination of the sensitive data. This action highlights the challenge social media companies face in balancing free speech with the need to prevent harm from doxxing and harassment.
The scope of the breach extends beyond simple contact details. By revealing which agencies have access to specific surveillance tools, the leak provides insight into the technological capabilities deployed by DHS components. This information could be used by malicious actors to identify vulnerabilities in specific operations or to target individuals associated with certain investigative units.
As the full impact of the breach becomes clear, questions remain about how the attackers bypassed Okta’s security measures and whether other systems within the DHS may have been compromised. The incident underscores the difficulty of protecting vast amounts of personnel data in an era of sophisticated cyber threats.
The release of this data marks a notable escalation in the targeting of U.S. government employees. While no evidence suggests that classified operational plans were stolen, the exposure of personal information for tens of thousands of workers represents a serious privacy violation. The DHS will likely face increased pressure to review its cybersecurity protocols and address the weaknesses that allowed this breach to occur.
Sources behind this briefing
Go to the original reporting
- The Verge↗A hacker stole more than 40,000 DHS employee records
- WIRED↗Bluesky Is Blocking Links to a Major Leak of DHS Employee Records
- Nextgov/FCW↗DHS personnel leak exposes contact details and sensitive job information
- TechCrunch↗Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents
