Massive Leak Exposes 41,000 Homeland Security Workers (wired.com) 31
A massive leak has exposed records tied to more than 41,000 DHS employees and contractors, including roughly 10,000 ICE personnel. The data, reportedly taken from DHS's Okta login system, reveals phone numbers, email and office addresses, reporting relationships, and permission groups associated with undercover operations, wiretapping and surveillance tools. Wired reports: In all, the leak provides a map of how DHS is organized and how it operates. The records, which span DHS itself as well as seven component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection, were last updated on August 19, 2026.
The transparency nonprofit Distributed Denial of Secrets and cybersecurity researcher and journalist maia arson crimew previewed the data to WIRED, which they say they obtained from a group calling itself the Department of Peace. DDoSecrets published the archive, which it calls "Icepick," on Wednesday. In a press release, DDoSecrets says the data is from DHS's Okta login system. In a note with the files, the hackers wrote, "They have our information, so it's only fair that we have theirs." An Okta spokesperson tells WIRED that it is unaware of any breach of its systems. "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised," the spokesperson says.
The transparency nonprofit Distributed Denial of Secrets and cybersecurity researcher and journalist maia arson crimew previewed the data to WIRED, which they say they obtained from a group calling itself the Department of Peace. DDoSecrets published the archive, which it calls "Icepick," on Wednesday. In a press release, DDoSecrets says the data is from DHS's Okta login system. In a note with the files, the hackers wrote, "They have our information, so it's only fair that we have theirs." An Okta spokesperson tells WIRED that it is unaware of any breach of its systems. "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised," the spokesperson says.
Re: (Score:3, Funny)
aw honey
doesn't it get old inventing imaginary enemies?
when the courts say that someone is a 'sex trafficker', that's not 'leftists'. The court isn't 'leftists'. You have enough enemies without inventing new ones. don't be greedy.
Re: (Score:1)
Just how often are you thinking about homosexuals?
Re: (Score:2)
Re: (Score:1)
I missed the part that said it involved leftists, fats, or lesbians.
Re: (Score:2)
Basic Directory Data (Score:2)
An Okta spokesperson tells WIRED that it is unaware of any breach of its systems. “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised,” the spokesperson says.
It just sounds like someone got a hold of a service or user account that could read the directory and asked nicely. Not being aware of data or systems being compromised is a little weasel wordy, but likely not Okta's fault here.
Oh No! (Score:3, Interesting)
It could not have happened to a more deserving bunch.
Welcome to the panopticon. Be seeing you!
Re: (Score:2)
I wonder how you'll feel when the DOJ decides the illegal immigration problem ultimately created by supporting an Open Border Czar for four years should be fixed and funded by taxing every registered Democrat at a well-deserved rate.
With another 10% tax tip added on for those wanting to declare themselves sanctuaries.
I believe Jack Reacher said it best.
"Remember. You wanted this."
First of all, I am not a Democrat, so it's no concern of mine.
Second, the DOJ still does not decide tax rates.
Finally, Remember. The pendulum swings both ways.
What was such info even doing online :o (Score:2)
Re: (Score:2)
It's easy to hate on Okta after the 2022-2023 issues. But having a directory get read is probably just getting a hold of an account and not the IdP's fault. Orgs get to choose their MFA factors, conditional access policies, and permissions.
Re: (Score:2)
SSO isn't even the relevant part here as it's just a simple directory lookup. Would be the same issue if it was AD or even plain LDAP without any of the new fangled IdP stuff that you're afraid of.
Public domain data is now public domain (Score:3, Insightful)
And now it is.
This is a super handy list I expect will inform future hiring decisions in many parts of the private sector. It has internal AD group data attached, which should help with identifying job function. Nobody wants to hire dangerous thugs except cop shops and gangs (but I repeat myself).
Re: (Score:3, Insightful)
Re: (Score:2)
You're not wrong in the sense that this is still a Federal crime and should be punished accordingly (not executions, that's insane) but here's your issue: now these same people are in charge of solving this crime and as this story gets at, these people are incompetent. [wikipedia.org]
Re:Public domain data is now public domain (Score:4, Interesting)
civil servant rosters should generally always be public.
Why though? These aren't elected officials, they aren't political positions. Why should their information be any more public than who your employer is (assuming you don't work for yourself in a small family owned business)?
This is a super handy list I expect will inform future hiring decisions in many parts of the private sector.
Because people have a tendency to hide past employment or make up gaps in their employment record? People typically will tell you who their previous employers are and often provide references and phone numbers to referees. This information should make no difference to your hiring decisions unless you are truly incompetent at candidate selection.
Good (Score:2)
Evidence (Score:2)
Well... except for the huge data dump of your supposedly restricted employee data...
Re: (Score:2)
as Himmy32 is carefully pointing out above - these aren't the same thing.
Okta provide an IdP; a client of their service can fuck it up and get their account compromised. How is that Okta's fault? You're one of those guys who was laughing at AWS when people made their S3 buckets public.
Re: (Score:2)
Please excuse my ignorance as I don't do web/server security, but shouldn't systems like these be able to notice a significant data dump then block it until confirmed through a different contact method?