Hacktivists leak 40,000 DHS personnel records

A hacktivist group calling itself the Department of Peace said it stole personnel records on more than 40,000 Department of Homeland Security employees by subverting DHS’s single sign-on system. The data went online on October 28. The records cover names, phone numbers, addresses and email addresses for agents, operatives and associates, including people working undercover. NPR’s reporting puts one count above 41,000, roughly a fifth of a workforce of about 220,000.

The group handed the raw data to Distributed Denial of Secrets, which posted it as a database called Icepick. A searchable front end was built by the Swiss activist maia arson crimew, who did the technical work, together with U.S. journalist Ryan Ottignon. More than 21,000 of the records identify Customs and Border Protection employees. About 10,000 cover Immigration and Customs Enforcement and its Homeland Security Investigations unit. Around 1,000 belong to the cybersecurity defense agency.

The detail that makes this more than a contact dump is structural: every personnel file carries the names of that person’s supervisors and direct reports. The published tool lets you walk the org chart in both directions, which DDoSecrets cofounder Emma Best said connects officials overseeing covert and undercover operations with personnel in the department’s rendition and deportation programs. Best called the leak “extraordinary but deceptive in its simplicity.”

The group framed the release as oversight. In a note attached to the files it wrote, “They have our information, so it’s only fair that we have theirs.” Activists involved said the names and addresses let investigators file more complete Freedom of Information Act requests, and Ottignon rejected the characterization of the release as doxing. The administration has pushed back against people publicly naming ICE officers and has regularly said those who dox them will be prosecuted.

For anyone running identity infrastructure, the stated vector is the detail to sit with. Single sign-on concentrates authentication into one identity provider whose tokens every downstream application trusts. That concentration is the point: one place to enforce MFA, one place to deprovision a departing employee, one audit trail. It also means a foothold in the identity provider, or the ability to mint or replay the tokens it signs, is a foothold in everything behind it. The sources describe the breach as “subverting” SSO and go no further on method. The result they do describe, tens of thousands of records spanning several component agencies pulled together, is what identity-layer access looks like rather than a string of separate per-system compromises.

Several things follow for defenders. Treat the identity provider’s token-signing key like a root CA key: HSM-backed, its use logged, and rotation a procedure you have actually run rather than one that exists only on paper. An attacker who can sign tokens needs no one’s password.

Treat directory data as sensitive in its own right. The supervisor and direct-report fields are ordinary HR and identity attributes, and they are exactly what turned a list of contacts into something readable as an org chart for covert operations. Scope who and what can enumerate the directory, and log bulk reads.

Watch issuance, not only login. Token minting with no matching interactive sign-in, bulk directory queries, and sessions from implausible locations are the signals that surface this class of access. Per-application logs will show thousands of authenticated requests that each app considers legitimate, because as far as each app knows, they were.

DHS said it is “aware of a potential breach and is actively working to address the situation” and is taking steps to ensure everyone is “properly protected.” The published set is not comprehensive; it covers about a fifth of DHS staff, and NPR places it alongside recent hacking of the FBI.

See also: NordVPN for tunneled traffic when operating outside controlled networks.

---

#ad Contains an affiliate link.