Data identifying more than 41,000 employees and contractors for the US Department of Homeland Security (DHS) was released on Wednesday in an unprecedented leak that reveals how the agency is organized. The records, which were made public by the transpaency nonprofit Distributed Denial of Secrets reference operation names, surveillance programs and information on undercover initiatives.
DHS did not immediately return a message seeking comment.
The leaked data unveils the names, phone numbers and email addresses of employees from various DHS agencies, including Immigration and Customs Enforcement, Customs and Border Protection, Homeland Security Investigations, the Cybersecurity and Infrastructure Security Agency.
Most of the agents in the leak – more than 21,000 – work for CBP, and about 6,600 work for ICE.
The data also includes job titles, email groups and other details that show which agents were assigned to special operations, surveillance jobs, computer forensics and undercover work.
It was made public at a time when DHS, in turn, has aggressively sought to unmask critics on social media, and obtain records on protestors and journalists – even as it moves to keep its own agents anonymous, defending agents’ rights to hide their identities and faces while conducting enforcement.
In a statement, Emma Best, a Distributed Denial of Secrets co-founder, said the hacktivist known as “maia arson crimew” developed a search tool for the data that would allow the public to browse it. Best said the tool would “replace anonymity with accountability” and empower journalists, guide public records requests and boost congressional oversight.
The Department of Peace did not immediately respond to a request for comment, but in a statement included with the data, it said that DHS employees “have our information, so it’s only fair that we have theirs” and that it hoped the data “can be used to limit further harm by the DHS and supports all efforts in that direction”.
The disclosure – which the non-profit data transparency group says draws on information obtained by an entity calling itself “Department of Peace” – is the third government data leak to have made headlines in the past month.
In September, the hacking group ShinyHunters claimed the theft of a massive trove of data from the Federal Bureau of Investigation, including sensitive job details and medical information from thousands of bureau employees. Last week, the defense department was hit with a class action lawsuit following a breach that exposed data on millions of current and former military personnel.
The Department of Peace in March claimed responsibility for hacking DHS and posting documents related to contracts with outside vendors.
Best’s statement said Department of Peace harvested the data from the Okta sign-on service used by DHS. Reuters could not immediately corroborate the claim. Okta said in response to a Reuters query: “Okta is secure, and we have no evidence our data or systems were compromised.”
Reuters could not immediately verify the authenticity of the entire data trove but it was able to match personal information of about six DHS employees named in the leak to credit bureau records and breach data carried by the dark web intelligence platform District 4 Labs. In other cases, Reuters called three DHS employees directly and was able to confirm their phone numbers and other details. One said it was the first they had heard of a breach.
In several cases, the data tracked information available on DHS employees’ LinkedIn profiles. But in others, the data revealed nonpublic data about internal DHS organization charts or previously undisclosed programs or operations.
