EXPLORINEER
en

US — The Verge

A hacker stole more than 40,000 DHS employee records

Security1 min read

A hacker stole personal data on more than 41,000 Department of Homeland Security (DHS) employees. The leak also links some staff to surveillance tools.

What happened

A hacker took a large set of employee records from the US Department of Homeland Security (DHS). The records include names, job titles, phone numbers, email addresses, and office locations. Staff at US Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP) are included. The data also ties some agencies to specific surveillance tools.

Key numbers

  • More than 41,000 employees have records in the leak.
  • About 21,000 records belong to CBP staff.
  • Nearly 7,000 records belong to ICE staff.
  • The data also includes records from CISA, USCIS, and HSI.
  • The hacker used the name "Department of Peace" and got in through Okta, a login service the DHS uses.

Some background

DHS is the US government department that protects the country's borders, immigration system, and cyber networks. ICE and CBP enforce immigration laws. The DHS has tried to hide the identities of agents who have carried out immigration raids. The leaked data was passed to a researcher, who shared it with DDoSecrets, a nonprofit group that now hosts the data. This leak came only weeks after hackers stole FBI employee data.

Why it matters

The leak puts the private details of thousands of government workers in public view. It can also expose which staff may work with surveillance tools, such as a facial recognition app and a tool that collects data from phones and online services. The DHS had not yet responded to requests for comment when the story was reported.

What to watch

  • Whether the DHS confirms the breach and explains how the hacker got in.
  • Whether more agency data is posted online.
  • How the leaked staff details are used, including any threats or harassment.
  • Whether other government agencies face similar attacks.

Glossary

DHS
The Department of Homeland Security, a US government agency that protects the country's borders, immigration, and cyber systems.
ICE
US Immigration and Customs Enforcement, an agency that enforces immigration laws inside the US.
CBP
US Customs and Border Protection, the agency that guards the country's borders and ports of entry.
Okta
A company that provides identity and access management, which controls who can log in to computer systems.
DDoSecrets
Distributed Denial of Secrets, a nonprofit group that publishes leaked data and is now hosting the leaked files.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityTechCrunch

Upwind raises $400M after walking away from Datadog acquisition offer

San Francisco AI cloud security startup Upwind has raised a $400 million Series C at a $3.8 billion valuation, led by Bessemer Venture Partners. According to a source, Datadog made an acquisition attempt but offered no premium above that valuation, so Upwind chose to remain independent. The company is projected to reach roughly $90 million in ARR by year-end.

SecurityTechCrunch

Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents

Personal and work contact data on more than 40,000 U.S. Department of Homeland Security employees, including CBP, ICE, HSI, and CISA staff, has been published online after a hacker claiming to be "Department of Peace" stole it from an Okta single sign-on system used by the department. The dataset also includes IT and log-in records showing which internal systems and apps employees can access. Homeland Security and Okta have not confirmed the breach details; Okta says it has no evidence its own systems were compromised.

SecurityZDNet Korea

Bank of America Tells Customers Not to Give AI Assistants Their Banking Passwords

Bank of America has advised customers not to share their online banking IDs and passwords with AI assistants or AI agents, including tools that offer to handle tasks on their behalf. According to TechCrunch, the bank sent the advice in an email titled "Protecting Financial Assets in the AI Era" on October 27, stating that transactions resulting from shared login information are the customer's responsibility. TechCrunch reported that an AI agent with account access could carry out financial transactions without the customer's knowledge, and that the bank might lock the account or login details could leak if the AI tool has security flaws.

SecurityITmedia

NEC Apologizes for Information Leak at Contractor, Says It Is Reflecting as a Security Business

At its Q2 earnings briefing on October 28, NEC Vice President and CFO Kazukazu Amemiya apologized for a security incident involving a contractor, saying that as a company in the security business it deeply regrets the incident. NEC had announced on October 20 that a system development and maintenance contractor was hit by a cyberattack in late September, affecting customers, and that a cloud storage service used for information sharing also leaked files containing personal data. Amemiya said NEC is prioritizing responses to regain customer trust and strengthening its management structure.