Hacker publishes data on 40,000 Homeland Security staff

Personally identifiable information belonging to more than 40,000 Department of Homeland Security employees has been published online after a hacker stole the data in a previously undisclosed breach earlier this year, TechCrunch reported on Wednesday. The dataset includes names, job titles and work contact information, including email addresses, cell phone numbers and office locations, for staff across the department, including some 21,000 Customs and Border Protection employees, another 10,000 at Immigration and Customs Enforcement and its Homeland Security Investigations unit, and just under 1,000 at the Cybersecurity and Infrastructure Security Agency.

The hacker, using the handle Department of Peace, said the data came from an Okta single sign-on system the department uses for employee logins, and the dataset was shared with the nonprofit collective DDoSecrets, which hosts leaked datasets. TechCrunch said it verified a portion of the data as authentic and that the records appear to have been taken around mid-August. A Homeland Security spokesperson did not immediately respond to TechCrunch’s request for comment, and Okta said it had no evidence its own data or systems were compromised.