Hackers claim to have leaked information on over 40,000 DHS employees via Okta breach; DDoSecrets has made it public.

October 29 - According to TechCrunch, a hacker claiming to be the "Department of Peace" alleges to have obtained a large amount of employee data from the Okta single sign-on system used by the U.S. Department of Homeland Security (DHS), which was publicly released by the data transparency organization Distributed Denial of Secrets (DDoSecrets) on Wednesday as the "Icepick" dataset. The leaked records exceed 40,000, accounting for about one-fifth of DHS's approximately 220,000 employees, involving names, positions, work emails, mobile phone numbers, and office locations, as well as associated internal system permissions and other information; about 21,000 of these are Customs and Border Protection (CBP) personnel, another approximately 10,000 involve Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI), and Cybersecurity and Infrastructure Security Agency (CISA) related records are close to 1,000.

TechCrunch stated it has verified the authenticity of some data, with record timestamps indicating the data was exported around mid-August; the hacker also provided the data to journalist and hacker maia arson crimew, who then passed it to DDoSecrets. Okta responded that its own systems and data were not breached; a DHS spokesperson has not yet responded to a request for comment. The report noted that this is the third U.S. government data breach to draw attention within the past month, following the theft of FBI personnel files and Pentagon personnel data.