EXPLORINEER
en

US — TechCrunch

Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents

Security2 min read

A hacker stole personal work data about tens of thousands of U.S. Homeland Security employees and posted it online. The data came from a login system called Okta that the department uses for its staff.

What happened

A hacker using the name "Department of Peace" took employee data from Homeland Security. The data includes names, job titles, work email addresses, cell phone numbers, and office locations. It has now been published online. The breach was not announced before this report. The hacker said they got the data from Okta, a single sign-on system. This is a tool that lets workers log in to many systems with one account.

Key numbers

  • More than 40,000 people's records are in the leaked data.
  • About 21,000 records belong to U.S. Customs and Border Protection (CBP) workers, who work at airports and other border crossings.
  • About 10,000 records belong to Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations unit.
  • Just under 1,000 records belong to staff at CISA, the U.S. cybersecurity defense agency.
  • The department has about 220,000 workers, so the leak is about one-fifth of its staff.

Background

This is not the first big government data leak this year. Earlier hacks took FBI agents' personnel records and data about military service members from the Pentagon. The same hacker also claimed to have taken thousands of Homeland Security contracts with private companies earlier this year. The leaked data appears to be real. TechCrunch checked part of it by matching names of known employees against an offline copy of the database.

Why it matters

The leak shows who works in sensitive jobs and how to contact them. It may also show which internal apps and systems each worker can use. This could help bad actors target staff. Homeland Security is a key issue for voters ahead of the U.S. midterm elections, so the leak adds to public concern. Okta says its own systems were not compromised, and it is unclear whether the weakness that allowed the breach has been fixed.

What to watch

  • Whether Homeland Security confirms the breach and explains how it happened.
  • Whether Okta finds a weakness that lets outsiders into customer accounts.
  • Whether the leaked employee data is used for scams, phishing, or attacks on staff.

Glossary

Okta
A company that makes login tools, so people can sign in to many work systems with one account.
single sign-on system
A login method where one password or sign-in gives access to many different apps.
Customs and Border Protection (CBP)
A U.S. government agency that guards airports, ports, and borders.
Immigration and Customs Enforcement (ICE)
A U.S. government agency that enforces immigration and customs laws.
CISA
The U.S. agency that defends government and key computer networks from cyber threats.

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityZDNet Korea

Bank of America Tells Customers Not to Give AI Assistants Their Banking Passwords

Bank of America has advised customers not to share their online banking IDs and passwords with AI assistants or AI agents, including tools that offer to handle tasks on their behalf. According to TechCrunch, the bank sent the advice in an email titled "Protecting Financial Assets in the AI Era" on October 27, stating that transactions resulting from shared login information are the customer's responsibility. TechCrunch reported that an AI agent with account access could carry out financial transactions without the customer's knowledge, and that the bank might lock the account or login details could leak if the AI tool has security flaws.

SecurityITmedia

NEC Apologizes for Information Leak at Contractor, Says It Is Reflecting as a Security Business

At its Q2 earnings briefing on October 28, NEC Vice President and CFO Kazukazu Amemiya apologized for a security incident involving a contractor, saying that as a company in the security business it deeply regrets the incident. NEC had announced on October 20 that a system development and maintenance contractor was hit by a cyberattack in late September, affecting customers, and that a cloud storage service used for information sharing also leaked files containing personal data. Amemiya said NEC is prioritizing responses to regain customer trust and strengthening its management structure.

SecurityITmedia

Unauthorized Access to JAL Reservation System Exposes Data of About 90,000 People, Including Passport Numbers for Some

Japan Airlines (JAL) and Japan Transocean Air (JTA) said that a provider of their reservation and check-in management system was accessed without authorization, and that reservation data for about 92,000 customers may have been viewed from outside. For about 2,000 of them, passport numbers, phone numbers, and other details may also have been viewed, while the companies said there was no sign of credit card numbers or passwords being leaked and no effect on flight operations. The affected provider, Amadeus IT Group, reported the intrusion on October 23, has completed necessary security measures, and has not confirmed any misuse of the information as of October 28.

SecurityThe Register

123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus

UK domain registrar 123 Reg says it suffered an "AI-driven cyberattack" on September 18 that exposed customer data, including contact details, VAT numbers and API product information. The company says its investigation found attacker infrastructure hosted in China and Singapore and suspects a China-linked group, possibly the same actor that used the open-source ARTEX tool against South Korean financial institutions. 123 Reg says it believes the attacker only read customer data but may have made copies, and has urged customers to be wary of unsolicited messages.