A data leak exposed details of over 40,000 US Department of Homeland Security employees on Wednesday. While a group claimed the information came through Okta, the company said its core systems were not compromised. The agency is now investigating the breach to protect staff and address the situation very effectively.
A data leak involving more than 40,000 US Department of Homeland Security (DHS) employees has raised questions about the security of sensitive government information, with the nonprofit group behind the disclosure claiming that the data was obtained through identity management service Okta.
The company, however, has said it has no evidence that its systems or data were compromised.
According to the market data, Okta has a market capitalisation of approximately $38.79 billion, annual revenue of $2.92 billion and net income of $235 million.
Distributed Denial of Secrets, a nonprofit data transparency organisation, announced on Wednesday that it published information relating to DHS employees, including personnel working in sensitive areas such as surveillance and human intelligence.
DHS acknowledged the possibility of a security incident and said it was investigating the matter.
The agency said in a statement it was "aware of a potential breach and is actively working to address the situation swiftly and effectively." It added that it was taking steps to protect its employees and would update the public "when more information is available."
The disclosure reportedly originated from an entity calling itself "Department of Peace". According to Distributed Denial of Secrets, the group obtained the information, marking the third major US government data leak to attract attention in the past month.
What information was exposed in the DHS data leak?
The leaked information reportedly contains names, telephone numbers and email addresses of employees working across several DHS agencies, including Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), Homeland Security Investigations and the Cybersecurity and Infrastructure Security Agency (CISA).
The dataset also contains employees' job designations and internal email groups. These details could reveal personnel assignments in specialised areas, including special operations, surveillance, computer forensics and undercover activities.
Distributed Denial of Secrets co-founder Emma Best said hacktivist and journalist maia arson crimew had developed a search tool to make the leaked information searchable by the public.
Best said the tool would "replace anonymity with accountability", helping journalists investigate the information, supporting public records requests and strengthening congressional oversight.
Crimew also said the tool would provide "FOIA material for years to come!"
The Department of Peace did not immediately respond to a request for comment. In a statement accompanying the leaked data, the entity said DHS employees "have our information, so it's only fair that we have theirs". It added that it hoped the disclosure "can be used to limit further harm by the DHS and supports all efforts in that direction."
(LiveMint couldn't independently verify the authenticity of the claim)
Responding to Reuters, Okta said, "Okta is secure, and we have no evidence our data or systems were compromised."
Reuters also said it could not immediately authenticate the entire dataset. However, it matched personal information relating to six DHS employees against credit bureau records and breach information available through dark web intelligence platform District 4 Labs.
The news agency also contacted three DHS employees directly and verified their telephone numbers and other details. One of them said they had not previously been informed of any breach.
While some information in the dataset was already publicly available through employees' LinkedIn profiles, other entries reportedly contained non-public details about DHS organisational structures, programmes and operations.
What is Okta and what does the company do?
Okta Inc. is a US-based identity and access management technology company headquartered in San Francisco, California. Founded in 2009 by Todd McKinnon and Frederic Kerrest, the company provides cloud-based software that helps organisations manage user identities and secure access to applications and digital services.
Its offerings include single sign-on services, which allow users to access multiple applications through one centralised login, as well as authentication tools for developers integrating identity controls into applications, websites and devices.
The company was originally incorporated as SaaSure Inc. before adopting the Okta name in 2010. It went public in 2017 through an initial public offering on the Nasdaq.
The company employs approximately 6,370 people.
In September, hacking group ShinyHunters claimed to have stolen a massive trove of information from the Federal Bureau of Investigation (FBI), comprising confidential job-related details and medical records of thousands of employees.
Separately, the US Department of Defense faced a class-action lawsuit last week over a data breach that allegedly compromised information belonging to millions of current and former military personnel.