Hackers Leak Data on 40,000 DHS Workers, Including 21,000 at Customs and Border Protection

The personal and work details of more than 40,000 Department of Homeland Security employees have been published online after a hacker stole them from a previously undisclosed breach earlier this year, according to TechCrunch, which reviewed the data. The Department of Homeland Security says it is investigating.

The leaked records include names, job titles and work contact information such as email addresses, cell phone numbers and office locations. They cover border and immigration agents, cybersecurity staff and senior department officials. More than half of the dataset, about 21,000 records, relates to employees of U.S. Customs and Border Protection. Roughly 10,000 more belong to staff at Immigration and Customs Enforcement and its Homeland Security Investigations unit, and just under 1,000 work at the Cybersecurity and Infrastructure Security Agency. Thousands of other records cover headquarters staff and agencies including U.S. Citizenship and Immigration Services and the Federal Protective Service.

A hacker who uses the handle Department of Peace claimed to have taken the data from an Okta single sign-on system that DHS uses to let employees and contractors log in to its central network. That system also holds information tied to each user's account, including which internal systems and applications they are allowed to reach. "They have our information, so it's only fair that we have theirs," the hacker wrote in a note left with the data, which TechCrunch saw. The hacker did not respond to the outlet's questions.

The records appear to have been pulled around mid-August, based on timestamps attached to each person's entry. TechCrunch said it is unclear whether the vulnerability that allowed the theft has been fixed, or whether DHS knew about it. The stolen data was passed to journalist and hacker maia arson crimew, who shared a copy with Distributed Denial of Secrets, a nonprofit that hosts leaked datasets. TechCrunch verified part of the data by matching the names of several known DHS employees against an offline copy of the database. The number of leaked records equals about one-fifth of DHS's workforce of roughly 220,000.

CNN reported that its preliminary review found at least some of the data to be accurate, and that the leak includes people who work on sensitive missions. CBS News reported that DHS opened an investigation after the hacker group claimed to have built a database of employees' personal information.

A DHS spokesperson said in a statement to TechCrunch: "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available." Okta, the identity company whose system the hacker named, said it was aware of the report. "Okta is secure, and we have no evidence our data or systems were compromised," a spokesperson said.

The leak is the latest in a string of breaches of federal personnel data. TechCrunch noted earlier hacks that took thousands of FBI agents' personnel records and the personal information of millions of current and former military personnel from the Pentagon's human resources unit. It is also the second DHS breach this year tied to the same hacker, who earlier claimed to have taken thousands of contracts between the department and private companies, including defense contractors and surveillance vendors.

The leak comes days before the Nov. 3 midterm elections, when DHS's deportation and detention operations are a major issue for voters. Publishing agents' names, phone numbers and office locations puts them at risk of harassment, which is why the department says it is working to protect its employees.