A Leak of 41,000 DHS Staff Records Blames Okta. Okta Says It Has No Evidence of a Breach

The leak is real enough to report and unproven enough to hedge. A group calling itself Department of Peace says it pulled records on more than 41,000 Department of Homeland Security employees and contractors out of DHS's Okta login system. Okta says it has no evidence anything was compromised. DHS says only that it is aware of a "potential breach."

What is in the files

TechCrunch reports the fields are names, job titles, work email addresses, cell phone numbers and office locations. Wired adds that the records span DHS itself and seven component agencies. Customs and Border Protection accounts for more than half, about 21,000 records by TechCrunch's count. Immigration and Customs Enforcement has about 10,000, roughly a third of them in its investigative arm, Homeland Security Investigations. Wired puts US Citizenship and Immigration Services at 6,200 and the Cybersecurity and Infrastructure Security Agency at nearly 1,000, more than half of those contractors.

The group names are where the sensitivity sits. Wired found 39 HSI employees in groups whose names include "CUC," which federal court filings say stands for certified undercover operation. It also found more than 200 CBP accounts in a group that references Mobile Fortify, a face-recognition app immigration agents use. TechCrunch found a Penlink PLX group with more than 2,000 HSI users. Penlink did not respond to TechCrunch's request for comment.

Alexander Leslie, a national security expert at the threat intelligence company Recorded Future, told Wired the data is an extraordinarily valuable intelligence resource if it is authentic and current. He said an adversary could use it to find vulnerable personnel and build convincing impersonation attempts.

Okta says no. The hackers say Okta.

Both outlets trace the claim that the data came from DHS's Okta system to the leak's publisher and the hackers. In a note with the files, the hackers wrote, "They have our information, so it's only fair that we have theirs." The Okta spokesperson's statement to both outlets covers Okta's own data and systems. It does not say whether a DHS-run account or configuration was involved, and neither outlet reports an answer. The hackers did not respond to TechCrunch, and TechCrunch lists the method of the breach as unknown.

Authenticity is also thinner than the headline numbers suggest. Wired and TechCrunch both received the data from the same sources, the researcher and journalist maia arson crimew and DDoSecrets, so they are not two independent confirmations of the dataset. TechCrunch checked a portion by matching names against an offline copy of a database of known DHS employees and says the data appears authentic. It did not verify the rest.

The two outlets also disagree on scale. TechCrunch says more than 40,000 records, about one-fifth of a DHS workforce of roughly 220,000. Wired says more than 41,000 and about a seventh of the workforce. Forty-one thousand over 220,000 is about 19 percent, which fits TechCrunch's fraction. Wired's fraction implies a larger headcount, and the difference is unexplained.

Ten weeks old, and not the first breach

If the August 19 date holds, the data was about ten weeks old when it went public on October 28. TechCrunch says timestamps point to exfiltration around mid-August. Wired found the files still list Kristi Noem, whom it describes as the former DHS head, and Antoine McCord, the recently departed chief information officer, so some entries are already out of date.

The base rate is not comforting, though there is no clean count to measure it against. Neither outlet gives one. TechCrunch says this is the second DHS breach this year from the same hacker, after a March claim of thousands of DHS contracts with private companies. It also points to recent breaches of FBI personnel records and Pentagon military personnel records. Wired cites a ShinyHunters claim to have taken personal information on nearly every FBI employee and their families.

The argument over what to call it

Wired reports that DHS has moved to hide employees' names and faces and widened its definition of doxing to cover basic facts about public employees, such as names and titles. In June, 15 Minnesota residents were charged under stalking and threat laws that prosecutors linked to ICE-opposition activity. Adam Steinbaugh, a senior attorney at the civil liberties group FIRE, told Wired the names and basic work details are the kind of thing printed on a business card, which the government cannot criminalize.

“This is information that would be on a business card.”

Steinbaugh was speaking about names and basic details. He did not say the same of undercover program groups or personal phone numbers, and the leak contains both. Crimew rejects the doxing label and calls the archive an accountability tool, arguing DHS lacks accountability. DHS told Wired it takes all security threats against its employees seriously.

Open items as of Thursday are specific. DHS has not said how the data left its systems, whether the hole is closed, or how many records are genuine. Until it does, the confirmed part is a published archive that an agency calls potential.