Hackers leaked details of more than 41,000 Homeland Security personnel

A hacktivist group stole records for more than 41,000 Homeland Security personnel and got help to release it on the web, according to Wired, the Washington Post and NPR. The leaked records contain email addresses, phone numbers and office addresses of the personnel, but they also include sensitive information about the agency's undercover and surveillance programs.

Of the records that were leaked, 21,000 identify people working with the US Customs and Border Protection, while 10,000 records belong to Immigration and Customs Enforcement (ICE) personnel. A third of those records is related to the Homeland Security Investigations unit, the criminal investigative arm of ICE. Overall, the leaks expose the details of a seventh of Homeland Security's workforce.

"On July 17th, Markwayne Mullin said he was 'turning up the heat.' This is what happens to ICE when you do that," the hacktivist group calling itself the Department of Peace said in a statement. They're talking about the DHS' Secretary's words during a press conference, wherein he said that the agency is "turning up the heat on the streets" when asked how it would hold the agents who violated its use of force policy accountable. The agency held the press conference following the fatal shootings of Joan Sebastian Duran Guerrero from Maine and Lorenzo Salgado Araujo from Houston, neither of whom were subject to ICE's enforcement activities.

The group apparently stole the data via Okta, the single sign-on service used by the DHS. With Okta, users just have to sign on once with their credentials to get full access to a system's backend, cloud service and/or mobile apps. Okta told Wired that it has found no evidence that its "data or systems were compromised." The hackers shared the data with transparency nonprofit Distributed Denial of Secrets and a Swiss cybersecurity researcher called maia arson crimew. They created a searchable online database using the information the Department of Peace had provided.

"They have our information, so it's only fair that we have theirs," the hackers wrote in a note with the stolen records. The Distributed Denial of Secrets is calling the database "Icepick." Its founder, Emma Best, said the records contain links between "officials responsible for overseeing covert and undercover operations ...along with key personnel in DHS's ever-escalating rendition and deportation programs."

Meanwhile, a Homeland Security spokesperson said it is "aware of a potential breach and is actively working to address the situation swiftly and effectively." They added: "We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available."