DHS Leak Exposes 41,000+ Employees and Contractors; Hackers Cite Okta, Which Denies a Breach
Okta says it has no evidence its systems were compromised, DHS says it is working to address a potential breach, and the entry point remains unconfirmed.
A leak of Department of Homeland Security records covers 41,191 employees and contractors and shows which internal systems and third-party services each person could reach, including groups tied to surveillance tools, AI platforms and government technology vendors. The hackers behind the leak claim they got the data through the Okta ($OKTA) sign-on service DHS uses. Okta says it has no evidence its data or systems were compromised, and the entry point remains unconfirmed.
Official source: Distributed Denial of Secrets, Icepick release
What was leaked
| Item | Details |
|---|---|
| Records | 41,191 people across nine DHS agencies, from nearly 7,000 offices and more than 2,200 locations |
| Fields | Names, job titles, agency and office details, work emails, phone numbers, managers and reports, employment status and Active Directory group memberships |
| Release | Published by the nonprofit Distributed Denial of Secrets as "Icepick," after a hacker using the name Department of Peace shared the data with journalist maia arson crimew |
| Timing | TechCrunch reported on Oct. 28 that timestamps suggest the data was taken around mid-August |
| Search tool | A searchable site for the data was taken offline the morning of Oct. 29 |
| Entry point | Unconfirmed; the hackers claim an Okta single sign-on service |
Records by agency
| Agency | Records | Share of leak |
|---|---|---|
| CBP | 21,329 | 51.8% |
| ICE | 6,598 | 16.0% |
| USCIS | 6,245 | 15.2% |
| HSI | 3,421 | 8.3% |
| DHS headquarters | 1,755 | 4.3% |
| CISA | 980 | 2.4% |
| FPS | 394 | 1.0% |
| FLETC | 337 | 0.8% |
| S&T | 132 | 0.3% |
The leaked records equal about one-fifth of DHS's workforce, or roughly 18.5% of the 222,538 headcount cited in reporting. CISA is excluded from the search tool's results.
What the access groups show
- Everyday software. Most employees appear in groups for Microsoft 365, Adobe Acrobat, Citrix and other desktop software.
- Surveillance vendor. Dozens of groups reference Penlink, a web-surveillance company with a long-running ICE contract. One group includes more than 2,000 Homeland Security Investigations users.
- Facial recognition. More than 200 CBP users are tied to Mobile Fortify, a facial-recognition app used by CBP and ICE.
- AI access. Several employees, including senior DHS officials, had ChatGPT access.
- Headspace. About 4,500 users, including ICE agents and deportation officers, were in a Headspace group. Headspace had an $82,500 ICE contract that ended in 2023, and the company says it has provided no services to DHS or ICE since.
- Investigations. Some groups relate to inquiries into the China-linked hacking groups Salt Typhoon and Volt Typhoon.
The Okta claim
The hacker group said the data came from the Okta single sign-on service DHS uses to give employees and contractors access to its central network. Okta said it is aware of the reports and has no evidence its data or systems were compromised. DHS said it is aware of a potential breach, is working to address it and will update the public when more information is available. Neither company nor agency has confirmed how the data was taken, and it is unclear whether any vulnerability has been fixed.
Business implications
- Identity security. The leak raises concerns about how government agencies secure single sign-on and identity systems.
- Vendor access. Group names show which vendors' tools were available to which teams, which raises questions about how access to outside services is controlled.
- Phishing risk. Accurate job titles, office locations and phone numbers make targeted phishing against DHS staff and contractors easier to craft.
- Financial impact. No vendor contract losses, system breaches or financial impacts have been confirmed.
Wider context
TechCrunch reported this is the second DHS breach this year attributed to the same hacker, after an earlier claim involving thousands of DHS contracts. Separately, the Pentagon disclosed that a flaw in its file-sharing system let unauthorized users reach sensitive personnel data for almost nine months, with about 3 million people believed affected.
Shares
Okta shares were down 2.44%, or $4.17, at $166.99 as of 3:10 p.m. ET Friday.
What to watch
- Entry point. Whether DHS, Okta or investigators identify how the data was taken.
- DHS update. Whether DHS shares more detail on the scope and any steps to protect employees.
- Vendor responses. Whether companies named in the access groups, such as Penlink, comment or change how their tools are provisioned.
- Further releases. Whether the hacker or DDoSecrets publishes additional data.
- Related coverage. See our Claude Personal Finance report, the OpenAI ChatGPT analytics story and the OpenAI CFO report.
Sources: Distributed Denial of Secrets (Icepick release), with reporting from TechCrunch, CyberScoop, Cybernews, The National Desk and Breached.Company. Share prices are from Google Finance. This article is informational only and is not investment advice.
Readers also read
Anthropic Launches Claude Personal Finance, Linking Bank Accounts Through Plaid in a U.S. Beta
NewsOpenAI Is Reportedly Building a Search Console-Style Analytics Tool for Businesses in ChatGPT
NewsOpenAI CFO Confirms $1.25T Raise Talks, Says Data Center Spending Continues Despite Voter Backlash
RecapNasdaq Falls 4.4% and VIX Jumps 45% as Chip Stocks Plunge on Data Center Worries
MarketCatalyst is not a registered investment advisor and does not manage client assets. Content on this platform is provided for informational and educational purposes only. It is not investment advice, and MarketCatalyst is not a stock-picking or trade-alert service. Trading stocks and options involves risk, including the possible loss of principal. Consider your own goals, time horizon, and risk tolerance, and consult a qualified financial advisor before making any investment decision.