More Than 40,000 Homeland Security Employees’ Data Leaked by Hackers

October 29 — According to Reuters, on 28 October local time the leak site Distributed Denial of Secrets, a non-profit that campaigns for data transparency, published data on more than 40,000 US Department of Homeland Security employees, including people in sensitive roles such as surveillance and human intelligence.

DHS said in response that after learning of a possible data breach it was actively taking steps to handle the matter as quickly as possible, that it would make sure employees were properly protected, and that it would inform the public once it had more information.

The leaked material was obtained by a group calling itself the Department of Peace. It is the third major data breach at a US government agency to draw wide attention in the past month.

In September the hacking group ShinyHunters claimed to have stolen large volumes of FBI data, including sensitive job information and medical records for thousands of employees. Last week the Department of Defense was hit with a class action over the leak of data on millions of serving and former military personnel.

The data spans several DHS agencies, including Immigration and Customs Enforcement, Customs and Border Protection, Homeland Security Investigations and the Cybersecurity and Infrastructure Security Agency. It includes employees’ names, phone numbers and email addresses.

The files also contain staff job titles and email group information, from which it is possible to identify which officers handle special operations, surveillance, computer forensics and undercover assignments.

The Department of Peace did not immediately respond to a request for comment, saying only in a statement released with the data: “DHS employees hold our information, so it’s only fair that we hold theirs. This data can help reduce the harm DHS does in future, and we support any action taken to that end.”

In March the same group claimed to have broken into DHS systems and published contracts between the department and outside suppliers.

By cross-checking credit bureau records and data collected by the dark-web intelligence platform District 4 Labs, Reuters confirmed that the personal details of six DHS employees matched. Reuters also contacted three DHS employees directly and verified details such as their phone numbers; one said they had not known a breach had occurred.

Some of the leaked data matches what DHS employees have posted publicly on LinkedIn, while other material covers internal organisational structures the department has not published, along with programmes and operations that were previously unknown outside it.