DHS hack: how 41,000 staff records leaked, and how to prevent it
The DHS hack exposed staff names, phones and the internal groups behind them. Here's how the hackers say they got in, and what could have stopped it.
On this page 6 sections ▾
TL;DR
- DHS only calls it a "potential breach" and Okta says its own systems weren't compromised, so exactly how the hackers got in is still unconfirmed.
- Named CBP, ICE and CISA staff are now easy targets for tailored phishing and impersonation, and it's still unclear whether the hole that let the data out has been closed.
- The records appear to have been taken around mid-August and stayed undisclosed until the leak went public, and at least one employee Reuters reached hadn't heard about it.
The DHS hack that went public on October 28 didn't need a single classified file to do real damage: the hackers say they copied the directory behind the department's single sign-on, and the plain old "who can access what" list for more than 41,000 employees and contractors turned out to be a map of how Homeland Security actually works, from undercover units down to the surveillance tools people are grouped with.
Quick facts
More than half the records belong to Customs and Border Protection, with 21,329 entries on the leak's search site.
Over 200 CBP accounts sit in a group tied to Mobile Fortify, the facial-recognition app CBP and ICE agents use to identify people and check their immigration status.
39 Homeland Security Investigations staff appear in groups for certified undercover operations.
Some groups relate to investigations into Salt Typhoon and Volt Typhoon, the China-backed hacking groups, and others are tied to ChatGPT access, including for senior officials.
It's the third big federal data breach in about a month, after FBI employee data in late September and a Pentagon breach affecting more than 3 million people.
#What happened in the DHS hack
A hacktivist group calling itself the Department of Peace passed the data to journalist and hacker maia arson crimew and to the transparency nonprofit Distributed Denial of Secrets (DDoSecrets), which published it as a dataset called Icepick. Crimew also built a search site that cleans up the raw records and lets anyone browse people, groups, offices and locations, including ICE and HSI staff by city. CISA employees are hidden from searches by default to keep the focus on DHS's law enforcement and intelligence arms.
The group tied the leak to DHS Secretary Markwayne Mullin's July 17 remark that the department was "turning up the heat" on immigration enforcement. It's also not the group's first run at DHS: in March it claimed a hack involving DHS contractor records. Crimew, for her part, says she wasn't involved in obtaining the data and worked on the story as a journalist.
They have our information, so it's only fair that we have theirs.
Crimew isn't new to leaks: she was behind the 2021 breach of surveillance camera maker Verkada, was charged in the US that year, and in 2023 found a copy of the US No Fly List sitting on an unsecured airline server. She lives in Switzerland, which doesn't extradite its own citizens without their consent.
#How it was done, as far as anyone has said
The hacker says the data came from the Okta single sign-on system DHS uses so employees and contractors across its agencies can log in to the central network. That system holds more than names: it keeps login records and details about which internal systems and apps each person is allowed to open, and the leak includes each person's memberships in the department's Active Directory groups, which are what grant access to tools like Microsoft 365, Citrix and Adobe Acrobat. The hacker didn't answer TechCrunch's questions about how the breach was carried out, and DHS hasn't said either.
ELI5: explain it simply▾
THE WORDS
- Single sign-on
- One login that opens all your work apps, instead of a separate password for each.
- Okta
- A company that runs single sign-on for organizations, deciding who gets into which apps.
- Active Directory
- Microsoft's master list of every user and computer in an organization.
- Group
- A named list of people who all get the same access, like "can open the payroll app".
THE IDEA
Picture an office building where one badge opens every door you're allowed through. The front desk keeps a binder listing every badge holder and which doors each one opens. The hackers say they got a copy of that binder, so they didn't need to open any doors to learn who works where and on what.
For your information
Okta told reporters it has no evidence its data or systems were compromised. That doesn't contradict the hackers' claim outright: Okta is speaking about its own platform, while the hackers point to the Okta service set up for DHS. A stolen login or a badly scoped access token on the customer side could expose data without Okta itself being breached, though nobody has confirmed that's what happened here.
Copying a directory can be surprisingly easy, because directories are built to be read. In a default Active Directory setup, any signed-in user can read the properties of other users, groups and computers, and the built-in Pre-Windows 2000 Compatible Access group is granted read access to user, group and computer objects across the domain. Nobody has said that's the route used against DHS, but it shows why one working account, or one connector with more read access than it needs, can be enough to walk off with an entire org chart.
#What leaked, and why the group names are the real problem
Each record covers a name, job title, work email, cellphone number and office location, plus the person's group memberships.
The search site indexes 55,603 Active Directory and Okta groups, and that's where the leak goes from "staff directory" to intelligence: group names include operation names, certified undercover operations, and tools like PenLink and Palantir's Falcon.
Dozens of groups reference PenLink, a surveillance company whose tools it says can track the location data of hundreds of millions of phones, ranging from a handful of people in local offices to more than 2,000 HSI users nationally. Some of it is oddly mundane, too: around 4,500 users, including ICE agents and deportation officers, are in a group called "Headspace_users", left over from an ICE contract with the online therapy provider that ended in 2023. Headspace says it hasn't worked with DHS or ICE since then, so the group appears to have outlived the contract by years.
Where it breaks
Group membership shows who was put on a list, not what they did. Being in a PenLink group doesn't prove someone used it in an investigation, and the HSI staff in undercover-operation groups include managers and supervisors, so they aren't all undercover agents. The danger is that the lists connect real names to programs, offices and bosses, which is plenty for someone trying to target or impersonate them.
For your information
Totals vary slightly between reports. The roughly 10,000 ICE figure some outlets use counts ICE together with its HSI investigations unit, and altogether the leak covers about one-fifth of DHS's roughly 220,000 staff.
#How the DHS hack could have been prevented
Without confirmed forensics nobody can name the one control that failed, but DHS's own inspector general had already flagged the weak spots. A July 2023 audit found that 159 of 190 departed ICE staff it checked (84%) still had access after their last day, and 25 kept it for at least 45 days. ICE agreed to fix things by June 28, 2024, yet 4 of the audit's 7 recommendations are still open. A September audit of CBP went further: all 76,000 CBP network users had access to one highly privileged service account, and 11 of its 12 recommendations remain open.
Detection has been a problem too. Earlier this year DHS staff twice dismissed signs of hackers inside the Homeland Security Information Network as false positives before confirming a breach.
- Limit who can read everythingMany accounts and app connectors only need to see themselves and a few groups, so remove default "read the whole directory" rights wherever apps don't break without them.
- Name groups for strangersGive sensitive groups neutral IDs instead of operation or program names, since a leaked directory then reveals far less.
- Cut access the day it endsTie account removal and role changes to HR events automatically, rather than waiting on a supervisor to remember.
- No shared admin accountsGive each admin their own privileged account and review service accounts on a schedule, so one stolen credential can't speak for thousands of people.
- Alert on bulk directory readsWatch for one account or token suddenly listing thousands of users and groups, which is a classic early sign of someone copying a directory.
- Phishing-resistant sign-inPut hardware keys or passkeys on admin accounts and anything that can export directory data, since passwords and push-approval codes can be phished.
Tip
Detecting directory enumeration doesn't require a big budget: the open-source Sigma project already publishes a rule that flags read access to domain users from accounts that aren't machine accounts, and Sigma rules are written to be converted for most common SIEMs.
Every fix on that list is identity and access work, the unglamorous side of security that SOC and compliance teams live in every day. Security Pro climbs from Linux fundamentals up through Security Operations, SOC Analyst and Compliance & Security Architecture levels in a simulated terminal, and Level 1 is free.
#Timeline
- Department of Peace claims an earlier DHS hack, releasing thousands of contracts between the department and private-sector vendors.
- Timestamps on the records suggest the directory data was copied around this time.
- The data is published as Icepick. Okta says it has no evidence its data or systems were compromised.
- DHS says it is aware of a potential breach and is working to protect affected staff.
#What happens next
DHS says it will update the public when it knows more. In the meantime the people in the leak have a practical problem: their names, offices and assignments are now public, which is exactly the context needed to make a phishing email or a fake IT help desk call sound convincing.
Was Okta hacked in the DHS breach?
Who hacked DHS?
Were classified documents leaked?
What should people in the leak watch for?
What this means for you
If you manage sign-ins anywhere, treat your directory like sensitive data: check which accounts and app connectors can read all of it, rename groups that give away what they're for, remove access the day a role ends, and set an alert for bulk reads. If you're building these skills, these links go to Security+ practice on CertPrep+ and the Security Operations level of Security Pro.
Sources