Hackers Steal and Publish Data on 41,000 Homeland Security Workers

Hackers Steal and Publish Data on 41,000 Homeland Security Workers 🚨

A group of hackers calling themselves the Department of Peace has reportedly stolen and published the personal details of over 41,000 individuals working for the US Department of Homeland Security (DHS). The department is aware of a potential breach. This group, which previously claimed to have stolen contract documents from the DHS in March, provided the data to Swiss hacktivist maia arson crimew, who published it in collaboration with the transparency collective DDoSecrets. The goal of this publication was to replace “anonymity with accountability,” as stated by DDoSecrets co-founder Emma Best.

According to TechCrunch, timestamps on the records indicate that the data was taken around mid-August. The hackers launched this attack in response to a statement made by DHS Secretary Markwayne Mullin on July 17, where he promised to “turn up the heat” with traffic stops.

The published data files, referred to as “Icepick,” encompass staff from nearly 7,000 offices. This includes names, work email addresses, phone numbers, office addresses, job titles, and membership in internal DHS groups. Among those affected are almost 6,600 employees from Immigration and Customs Enforcement (ICE) and over 21,000 from Customs and Border Protection (CBP), along with personnel from the Cybersecurity and Infrastructure Security Agency (CISA).

Reuters has matched data from six DHS employees to credit bureau records and breach data from a dark web intelligence platform. Online activists frequently utilize open-source intelligence (OSINT) to “doxx” individuals, meaning that even a leak of basic identity information can pose a significant risk. The leaked data also included membership in groups within Active Directory, a Microsoft tool that manages identity information about computer users, controlling access to various internal tools and services.

The files listed over 200 CBP users in a group with access to the facial recognition tool Mobile Fortify. Other groups referenced a service called Penlink, which claims to track the location data of hundreds of millions of mobile devices. Job titles in the data dump reveal which agents were assigned to sensitive roles such as special operations, surveillance, and undercover work.

The Department of Peace stated that it accessed this information via a single sign-on (SSO) service provided by identity company Okta. SSO is a prime target for hackers, as a single authentication can grant access to multiple workplace services and applications. Although Okta claims it has no evidence that its data or systems were compromised, this does not eliminate the possibility of someone abusing a DHS account with stolen credentials.

This breach could enable attackers to create convincing messages or calls, potentially exposing some employees to unwanted attention or threats. DHS has issued warnings about the risks of harassment, stalking, and physical harm.

Important Security Advice for DHS Employees:

• Follow security advice and instructions from the DHS.
• Treat unexpected calls, emails, and texts about your role or colleagues with caution.
• Verify them through a trusted contact method.
• Never share passwords or MFA codes.
• Change any personal passwords reused for work and enable MFA where available.
• Follow your agency’s process for work accounts.
• Report suspicious contact or threats to your agency’s security team.
• If you believe there’s an immediate danger, contact law enforcement.

For more details, Read full article!