The U.S. Department of Homeland Security (DHS) has experienced a significant data breach, with sensitive information belonging to over 40,000 employees being exposed. The non-profit organization Distributed Denial of Secrets (DDoSecrets), known for its work in promoting data transparency, released the trove of data on October 28th. This breach is the third major U.S. government data leak to gain widespread attention in the past month.
Sensitive Information Exposed
The leaked data includes names, phone numbers, and email addresses of DHS employees. Critically, it also contains details about their job roles and email groups, allowing for the identification of law enforcement personnel involved in sensitive operations such as special assignments, surveillance, computer forensics, and undercover missions. This information impacts various DHS sub-agencies, including Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), Homeland Security Investigations (HSI), and the Cybersecurity and Infrastructure Security Agency (CISA).
“Department of Peace” Claims Responsibility
The data was reportedly obtained by a group calling itself the “Department of Peace” (DoP). In a statement accompanying the release, the group stated, “The DHS has our information, so it is only fair that we have theirs. This data will help reduce the harm caused by the DHS in the future and support all actions taken towards that goal.” This is not the first time the DoP has targeted the DHS; in March, the group claimed to have infiltrated DHS systems and released documents pertaining to contracts with external vendors.
DHS Response and Verification
A DHS spokesperson confirmed awareness of the potential data leak and stated that the department is actively taking steps to address the situation promptly and appropriately. “The Department will ensure employees are properly protected and will provide further information to the public as it becomes available,” the spokesperson added. Reuters verified a portion of the leaked data by cross-referencing it with credit bureau records and dark web intelligence platform District 4 Labs, finding matches for the personal information of six DHS employees. Reuters also directly contacted three DHS employees, confirming their phone numbers and other details. One of the contacted employees expressed surprise, stating they were unaware of any data breach.
Some of the leaked information aligned with publicly available details on employees’ LinkedIn profiles. However, the leak also included information about the DHS’s internal organizational structure that had not been previously disclosed, as well as details about projects or operations unknown to the public.
Broader Context of Government Breaches
This incident follows two other high-profile data breaches affecting U.S. government entities. In September, the hacker group ShinyHunters claimed to have stolen a substantial amount of data from the Federal Bureau of Investigation (FBI), including sensitive post information and medical records of thousands of employees. More recently, the U.S. Department of Defense faced a class-action lawsuit due to a leak of data concerning millions of active and former military personnel.
