‘A severe operational failure that places the physical safety of undercover personnel at direct risk’: Hacktivist group leaks data on 40,000 Department of Homeland Security staff

Data belonging to more than 40,000 employees at the Department of Homeland Security (DHS) has been leaked online in a move cyber experts have described as a “severe operational failure”.

A hacktivist group dubbed the ‘Department of Peace’ published the information on agents, which was then distributed online by transparency collective Distributed Denial of Secrets under a database codenamed ‘Icepick’.

As the database name suggests, a significant portion of employees exposed in the incident work for the Immigration and Customs Enforcement (ICE) and Customs and Border Protection agencies.

Leaked details include names, job titles, email addresses, and phone numbers of employees, as well as information on agents working on surveillance operations, undercover work, and other various activities.

In a statement, the DHS said it is “aware of a potential breach and is actively working to address the situation swiftly and effectively”.

The federal department added that it will provide more information in due course and will “work to ensure all [agents] are properly protected”.

Dray Agha, senior manager for tactical response at cybersecurity firm Huntress, said the incident is “a severe operational failure that places the physical safety of undercover personnel at direct risk”.

“Exfiltrating this directory data gives hostile actors a complete map of sensitive departments and their internal reporting structures,” Agha commented.

Compromised identity behind DHS breach

The hacktivist group behind the attack claims it gained access to DHS systems through Identity and Access Management (IAM) platform Okta, using exposed user credentials.

A spokesperson for Okta told ITPro: "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised."

Graeme Stewart, head of public sector at Check Point, said the incident is a “stark reminder that identity is now the front door for attackers”.

“If the reports are right and the attackers got in by abusing a single sign-on system, then one compromised login was enough to reach the personnel records of tens of thousands of people,” he said.

Stewart echoed Agha’s comments on the nature of information exposed in the breach, warning that this poses a real-world threat for agents working across a range of departments.

“The most worrying part is not the volume of data but its nature. Job titles and contact details for people working in surveillance and undercover roles create a real-world safety risk, not just a privacy one,” he added.

“Exposed data like this also tends to fuel follow-on phishing and impersonation campaigns for months afterwards.”

Government workers in the crosshairs

The DHS data leak comes just weeks after a similar incident involving the Federal Bureau of Investigation (FBI).

As ITPro reported in September, the ShinyHunters threat group claimed responsibility for a breach at the law enforcement agency, stealing information on thousands of agents.

Compromised data included agent names, badge numbers, and even home addresses.

In a similar vein to the DHS breach, exposed information also included highly sensitive data on investigations into foreign intelligence and drug cartel activities.

Security experts told ITPro at the time this data could have severe real-world consequences if it fell into the wrong hands.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.