Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents

Personally identifiable information belonging to thousands of U.S. Department of Homeland Security employees has been published online after a hacker stole reams of data in a previously undisclosed breach at the government department earlier this year.

The breach includes names, job titles, and work contact information, such as email addresses, cell phone numbers, and office locations, of more than 40,000 people who work for the federal department, including border and immigration agents, cybersecurity staffers, and senior department officials.

A hacker who goes by the handle Department of Peace claimed they obtained the data from an Okta single sign-on system used by Homeland Security to allow employees and contractors across its various agencies to log in to its central network. The Okta system also contains IT and log-in records associated with the employees’ user account, including details about which systems and internal apps they are permitted to access.

More than half of the dataset — some 21,000 records — relate to employees with U.S. Customs and Border Protection (CBP), who work at airports and other ports of entry. 

The data also contains records associated with another 10,000 employees of Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) unit, and just under a 1,000 employees who work at U.S. cybersecurity defense agency CISA. 

Thousands of additional records relate to staff who work at the department’s headquarters and its other agencies, including U.S. Citizenship and Immigration Services and the Federal Protective Service.

“They have our information, so it’s only fair that we have theirs,” said Department of Peace in a note left with the data, which TechCrunch has seen. The hacker did not respond to TechCrunch’s email requesting comment and with questions about how the breach was carried out.

This is the latest data breach to hit the U.S. government in recent months, following earlier hacks involving the theft of thousands of FBI agents’ personnel records and the personal information of millions of serving and former military service personnel from the Pentagon’s human resources unit. It’s also the second breach involving Homeland Security this year, after the same hacker claimed to have taken thousands of contracts between the department and the private sector, including defense contractors and surveillance vendors.

The latest batch of breached data, which appears authentic, offers a rare — albeit incomplete — view into the scale and operations of Homeland Security, whose deportations, arbitrary detentions, and killings of U.S. citizens under its leadership have become a key issue for voters ahead of the upcoming U.S. midterm elections.

The stolen Homeland Security data was provided to journalist and hacker maia arson crimew, who then shared a copy with DDoSecrets, a nonprofit collective that hosts leaked datasets in the public interest.

TechCrunch verified a portion of the data as authentic by matching the names of several known Homeland Security employees against an offline copy of the database. The thousands of employee directory records appear to have been exfiltrated around mid-August, according to the timestamps on each person’s record. The number of leaked records is equivalent to about one-fifth of Homeland Security’s workforce, which totals around 220,000 staff.

It’s unclear whether the vulnerability that allowed the breach has been fixed or if Homeland Security is aware of the data theft. 

A spokesperson for Homeland Security did not immediately respond to TechCrunch’s request for comment about the breach.

When reached, Okta said it was aware of this report. “Okta is secure, and we have no evidence our data or systems were compromised,” a spokesperson said.

While the leaked data includes identifiable information about agents and officers, the dataset also reveals more about the surveillance technologies and cybersecurity tools that Homeland Security employees may be able to access. Critics have called for investigations into tech companies that fund or provide their technology to ICE. 

The leaked data contains information about employees’ membership in user groups within the department’s Active Directory, a system that controls access to the department’s internal tools, services, and third-party offerings used for work. 

Most of the Homeland Security employees in the dataset were members of the user group that had access to Microsoft 365, the tech giant’s cloud service that hosts the agency’s emails and files, as well as user groups for accessing Adobe Acrobat, Citrix, and other typical desktop software.

The data also shows that around 4,500 users, including ICE agents and deportation officers, are members of a group called “Headspace_users.” Online therapy provider Headspace previously had an $82,500 federal contract with ICE that ended in 2023 to fund “mental health software required for ERO employees,” a reference to ICE’s deportation unit. 

A spokesperson for Headspace said the company has not provided any services to DHS or ICE since 2023.

Dozens of other user groups reference Penlink, a web surveillance company that makes technology it claims can track the location data of hundreds of millions of mobile devices. Penlink has had a contract with ICE for years. The user groups vary in size, from a handful of users in local Homeland Security offices around the country to more than 2,000 users across ICE’s HSI unit nationally. One group specifically references Penlink PLX, which the company says is used to capture and analyze “real-time intelligence” from phone calls, texts, web activity, and social media. 

A spokesperson for Penlink did not respond to a request for comment.

One user group also includes more than 200 CBP users associated with Mobile Fortify, a facial-recognition app used by both CBP and ICE agents to identify people and verify their information and immigration status.

The user groups also include several employees associated with ChatGPT access, including senior DHS officials, as well as other groups associated with investigations into the China-backed hacking groups known as Salt Typhoon and Volt Typhoon.

Researchers and public information advocates say that the exposed data could provide valuable leads for investigations into alleged abuses by the Trump administration, such as identifying email addresses of agents that can be used in public records requests under the Freedom of Information Act.

“Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results,” said Ryan Shapiro, the executive director of transparency nonprofit Property of the People. 

“Given the Trump administration’s contempt for even basic transparency, the need for such tools is urgent,” said Shapiro.

DDoSecrets co-founder and journalist Emma Best said that the exposed Homeland Security data will be a “catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests.”