Hackers Leak 41,000 DHS Employee Records Including ICE and CBP Agents

Major Breach Exposes Federal Workforce Data

A significant cybersecurity incident has resulted in the public exposure of personal information belonging to more than 41,000 employees of the United States Department of Homeland Security. The data dump, which includes names, job titles, phone numbers, email addresses, and office locations, was published online on Wednesday. The leak affects personnel across several key divisions within the department, including Immigration and Customs Enforcement, Customs and Border Protection, and the Cybersecurity and Infrastructure Security Agency.

Attribution and Method of Attack

The breach has been attributed to a hacker group calling itself the Department of Peace, working in conjunction with cybersecurity researcher maia crimew. The data was hosted on a website supported by Distributed Denial of Secrets, a platform known for publishing leaked information. According to reports, the attackers gained access to the sensitive records by compromising Okta, an identity and access management service utilized by the DHS. This method of intrusion highlights potential vulnerabilities in third-party vendor security protocols that support critical government infrastructure.

Scope of Compromised Information

The leaked database, named Icepick, contains detailed profiles of federal employees. Approximately 21,000 of the records pertain to employees of Customs and Border Protection, while nearly 7,000 belong to staff within Immigration and Customs Enforcement. Additional records include personnel from Homeland Security Investigations, the Federal Protective Service, and US Citizenship and Immigration Services. Beyond basic contact information, the leak includes descriptions of the work performed by these agents, dozens of previously unknown operation names, and details about the technology used in their investigations.

Involvement of Surveillance Technology Vendors

The exposed data also links federal agencies to specific surveillance tools and technologies. Records indicate the use of technology provided by companies such as Cellbrite and Palantir. This disclosure provides insight into the digital infrastructure employed by US immigration enforcement agencies, potentially revealing the scope of their monitoring capabilities. The inclusion of operational details and vendor relationships adds a layer of complexity to the breach, as it may compromise ongoing investigations or reveal sensitive law enforcement methodologies.

Context of Recent Federal Data Breaches

This incident marks the third major leak targeting a US government agency in recent weeks. Previously, hackers stole data from the Federal Bureau of Investigation, exposing information about its employees and job applicants. The recurrence of such breaches suggests a coordinated effort or a series of successful attacks against federal cybersecurity defenses. The Department of Homeland Security has not yet issued an official comment regarding the breach, though representatives were contacted for statement.

Motivations and Reactions

The Department of Peace justified the leak as a response to the DHS's efforts to conceal the identities of agents involved in anti-immigration raids. In a statement, the group argued that since the government hides the identities of its enforcement officers, it is only fair that the public has access to theirs. The hackers also noted that the information was provided to cybersecurity researchers for verification. The leak has sparked debate regarding government transparency, agent safety, and the security of federal data systems. As the situation develops, analysts warn that the exposure of agent identities could pose significant risks to the personal safety of federal employees and their families.

Key takeaways

• Over 41,000 Department of Homeland Security employee records have been leaked online.

• The breach includes data from Immigration and Customs Enforcement, Customs and Border Protection, and other agencies.

• Attackers accessed the data through a vulnerability in Okta, an identity management service.

• The leak includes operational details and information on surveillance technology vendors.

• This is the third major federal data breach in recent weeks, following an incident involving the FBI.

• The hackers claim the leak is retaliation for the concealment of agent identities during immigration enforcement.