Leak website says it has released personal data on 40,000 DHS employees

Leak website notes it has issued personal data on 40, 000 DHS employees.

Key points

• (Reporting by Raphael Satter and AJ Vicens; Editing by Edmund Klamann and Stephen Coates).
• WASHINGTON – The leak website Distributed Denial of Secrets remarked Wednesday, Oct.
• Best's statement remarked the Department of Peace harvested the data from the Okta OKTA.O sign-on service employed by DHS.
• According to The hacking group ShinyHunters, they had breached the FBI, stealing data on numerous current and former agency employees.

Leak website notes it has issued personal data on 40, 000 DHS employees. Raphael Satter and AJ Vicens Reuters. Hacking group steals sensitive FBI data, holding it hostage.

WASHINGTON – The leak website Distributed Denial of Secrets remarked Wednesday, Oct. 28, it has published data on more than 40, 000 Department of Homeland Security employees, including details concerning authorities working in sensitive fields such as surveillance and human intelligence.

DHS remarked in an official note it was "aware of a potential breach and is actively working to address the situation swiftly and effectively." The agency stated it was working to ensure its employees were properly protected and would update the public "when more information is available."

In practice, the disclosure – which the nonprofit data transparency group notes draws on information obtained by an entity calling itself "Department of Peace" – is the third major administration data leak to have created headlines previously month.

In September, the hacking group ShinyHunters asserted the theft of a massive trove of data from the Federal Bureau of Investigation, including sensitive job details and medical information from thousands of bureau employees. Last week, the Defense Department was hit with a class-action lawsuit after a breach that exposed data on millions of current and former military personnel.

For context, the DHS data includes names, phone numbers and email addresses of employees from Immigration and Customs Enforcement, Customs and Border Protection, Homeland Security Investigations, the Cybersecurity and Infrastructure Security Agency, and other DHS component agencies.

Additionally included in the data were job titles and email groups, which, among other details, demonstrated which agents were assigned to special operations, surveillance jobs, computer forensics and undercover work.

In an official note, Distributed Denial of Secrets co-founder Emma Best remarked the hacktivist known as "maia arson crimew" developed a search tool for the data that would allow the public to browse it. Best remarked the tool would "replace anonymity with accountability" and empower journalists, guide public records requests and boost congressional oversight.

Notably, the Department of Peace did not immediately respond to a request for comment, but in an official note included with the data it remarked that DHS employees "have our information, so it's only fair that we have theirs" and that it hoped the data "can be used to limit further harm by the DHS and supports all efforts in that direction."

In practice, the Department of Peace in March remarked it was responsible for hacking DHS and posting documents related to contracts with outside vendors.

Best's statement remarked the Department of Peace harvested the data from the Okta OKTA.O sign-on service employed by DHS. Reuters could not immediately corroborate the claim. Okta remarked in response to a Reuters query: "Okta is secure, and we have no evidence our data or systems were compromised."

Reuters could not immediately verify the authenticity of the entire data trove but it was able to match personal information regarding six DHS employees named in the leak to credit bureau records and breach data carried by the dark web intelligence platform District 4 Labs. Reuters called three DHS employees directly and was able to confirm their phone numbers and other details. One remarked it was the first they had heard of a breach.

In a number of cases, the data tracked information available on DHS employees' LinkedIn profiles. But in others, the data made public nonpublic data concerning internal DHS organization charts or previously undisclosed programs or operations.

(Reporting by Raphael Satter and AJ Vicens; Editing by Edmund Klamann and Stephen Coates). Share your feedback to support improve our site!

In short, leak website says it has released personal data on 40, 000 DHS employees is the central thread here, and readers can expect follow-up reporting as the picture becomes clearer.