Leak group posts data on 41,000 DHS staff; Okta denies link
DDoSecrets released a file with names, offices and contacts for ICE, CBP and CISA personnel. DHS says it knows of a "potential breach."
Distributed Denial of Secrets (DDoSecrets), a nonprofit that publishes leaked material, posted a file called "Icepick" on Wednesday holding data on more than 41,000 people who work for the U.S. Department of Homeland Security, both employees and contractors. The 166.70 MB archive lists names, offices, contact details and assignments.
DHS says it is aware of a "potential breach" and is working to address it. DDoSecrets says the data came from an Okta single sign-on service the department used, a login that lets someone reach many applications with one account. Okta rejects that, saying it found no sign its systems or information were compromised.
That disagreement is the central open question. The technical origin comes from the group that handed over the data and from DDoSecrets, and no one outside them has confirmed that the records are current or that they came from Okta.
The source is a hacktivist group calling itself Department of Peace. It gave the data to DDoSecrets and to the hacker maia arson crimew, who also built a public search tool on top of it. Most records belong to CBP, ICE and HSI, DDoSecrets says. Those agencies run immigration and border operations that directly affect Mexicans. About 1,000 belong to CISA, the federal cybersecurity agency.
DDoSecrets defends the release. Cofounder Emma Best argues that Icepick is not an indiscriminate directory but identifies "many of the architects" of covert operations, leak investigations and deportation programs. Ryan Shapiro, of the group Property of the People, calls the need for such tools "urgent."
The hackers gave a reason. On July 17, DHS Secretary Markwayne Mullin said he was "turning up the heat" on ICE. "This is what happens to ICE when you do that," a spokesperson for the group said.
