Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents

Personally identifiable information belonging to thousands of U.S. Department of Homeland Security employees has been published online after a hacker stole reams of data in a previously undisclosed breach at the government department earlier this year. The breach includes names, job titles, and work contact information, such as email addresses, cell phone numbers, and office locations, of more than 40,000 people who work for the federal department, including border and immigration agents, cybersecurity staffers, and senior department officials.

在今年早些时候美国国土安全部发生的一起此前未披露的数据泄露事件中，一名黑客窃取了海量数据，导致数千名国土安全部员工的个人身份信息被发布在网上。此次泄露的信息包括该联邦部门 4 万多名员工的姓名、职称和工作联系方式（如电子邮件地址、手机号码和办公地点），受影响人员涵盖边境和移民特工、网络安全人员以及部门高级官员。

A hacker who goes by the handle Department of Peace claimed they obtained the data from an Okta single sign-on system used by Homeland Security to allow employees and contractors across its various agencies to log in to its central network. The Okta system also contains IT and log-in records associated with the employees’ user account, including details about which systems and internal apps they are permitted to access.

一名自称“和平部”（Department of Peace）的黑客声称，他们是从国土安全部使用的 Okta 单点登录系统中获取了这些数据，该系统允许其下属各机构的员工和承包商登录中央网络。Okta 系统还包含与员工用户账户相关的 IT 和登录记录，包括他们获准访问哪些系统和内部应用程序的详细信息。

More than half of the dataset — some 21,000 records — relate to employees with U.S. Customs and Border Protection (CBP), who work at airports and other ports of entry. The data also contains records associated with another 10,000 employees of Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) unit, and just under a 1,000 employees who work at U.S. cybersecurity defense agency CISA. Thousands of additional records relate to staff who work at the department’s headquarters and its other agencies, including U.S. Citizenship and Immigration Services and the Federal Protective Service.

该数据集的一半以上（约 2.1 万条记录）涉及在美国机场和其他入境口岸工作的美国海关及边境保卫局（CBP）员工。数据中还包含与美国移民及海关执法局（ICE）及其国土安全调查处（HSI）的另外 1 万名员工，以及在美国网络安全防御机构 CISA 工作的近 1000 名员工相关的记录。此外，还有数千条记录涉及在国土安全部总部及其下属其他机构（包括美国公民及移民服务局和联邦保护局）工作的员工。

“They have our information, so it’s only fair that we have theirs,” said Department of Peace in a note left with the data, which TechCrunch has seen. The hacker did not respond to TechCrunch’s email requesting comment and with questions about how the breach was carried out. This is the latest data breach to hit the U.S. government in recent months, following earlier hacks involving the theft of thousands of FBI agents’ personnel records and the personal information of millions of serving and former military service personnel from the Pentagon’s human resources unit.

“他们掌握了我们的信息，所以我们掌握他们的信息也是公平的，” “和平部”在随数据留下的一份说明中写道，TechCrunch 已经看到了这份说明。该黑客没有回复 TechCrunch 询问评论以及关于泄露是如何实施的电子邮件。这是近几个月来美国政府遭遇的最新一起数据泄露事件，此前曾发生过数千名 FBI 特工的人事记录以及五角大楼人力资源部门数百万现役和退役军人的个人信息被窃取的黑客攻击事件。

It’s also the second breach involving Homeland Security this year, after the same hacker claimed to have taken thousands of contracts between the department and the private sector, including defense contractors and surveillance vendors. The latest batch of breached data, which appears authentic, offers a rare — albeit incomplete — view into the scale and operations of Homeland Security, whose deportations, arbitrary detentions, and killings of U.S. citizens under its leadership have become a key issue for voters ahead of the upcoming U.S. midterm elections.

这也是今年涉及国土安全部的第二起泄露事件，此前同一名黑客声称窃取了该部门与私营部门（包括国防承包商和监控供应商）之间的数千份合同。最新一批泄露的数据看起来是真实的，它提供了一个罕见（尽管不完整）的视角，让人们得以窥见国土安全部的规模和运作情况。在其领导下进行的驱逐出境、任意拘留以及杀害美国公民的行为，已成为美国中期选举前选民关注的一个关键问题。

The stolen Homeland Security data was provided to journalist and hacker maia arson crimew, who then shared a copy with DDoSecrets, a nonprofit collective that hosts leaked datasets in the public interest. TechCrunch verified a portion of the data as authentic by matching the names of several known Homeland Security employees against an offline copy of the database. The thousands of employee directory records appear to have been exfiltrated around mid-August, according to the timestamps on each person’s record.

被盗的国土安全部数据被提供给了记者兼黑客 maia arson crimew，随后她将一份副本分享给了 DDoSecrets，这是一个出于公共利益托管泄露数据集的非营利组织。TechCrunch 通过将几名已知国土安全部员工的姓名与数据库的离线副本进行比对，验证了部分数据的真实性。根据每条记录上的时间戳，这数千条员工名录记录似乎是在 8 月中旬左右被窃取的。

The number of leaked records is equivalent to about one-fifth of Homeland Security’s workforce, which totals around 220,000 staff. It’s unclear whether the vulnerability that allowed the breach has been fixed or if Homeland Security is aware of the data theft. A spokesperson for Homeland Security did not immediately respond to TechCrunch’s request for comment about the breach. When reached, Okta said it was aware of this report. “Okta is secure, and we have no evidence our data or systems were compromised,” a spokesperson said.

泄露的记录数量约占国土安全部总员工数（约 22 万人）的五分之一。目前尚不清楚导致此次泄露的漏洞是否已修复，也不清楚国土安全部是否知晓此次数据窃取事件。国土安全部发言人没有立即回应 TechCrunch 关于此次泄露的置评请求。Okta 在被联系时表示已知悉该报告。一位发言人称：“Okta 是安全的，我们没有证据表明我们的数据或系统受到损害。”

Thousands of ICE agents’ access linked to web surveillance tools, online therapy. While the leaked data includes identifiable information about agents and officers, the dataset also reveals more about the surveillance technologies and cybersecurity tools that Homeland Security employees may be able to access. Critics have called for investigations into tech companies that fund or provide their technology to ICE. The leaked data contains information about employees’ membership in user groups within the department’s Active Directory, a system that controls access to the department’s internal tools, services, and third-party offerings used for work.

数千名 ICE 特工的访问权限与网络监控工具和在线治疗相关。虽然泄露的数据包含有关特工和官员的可识别信息，但该数据集还揭示了更多关于国土安全部员工可能能够访问的监控技术和网络安全工具的信息。批评人士呼吁对那些资助 ICE 或向其提供技术的科技公司进行调查。泄露的数据包含有关员工在部门 Active Directory（一个控制对部门内部工具、服务和用于工作的第三方产品访问权限的系统）中用户组成员身份的信息。

Most of the Homeland Security employees in the dataset were members of the user group that had access to Microsoft 365, the tech giant’s cloud service that hosts the agency’s emails and files, as well as user groups for accessing Adobe Acrobat, Citrix, and other typical desktop software. The data also shows that around 4,500 users, including ICE agents and deportation officers, are members of a group called “Headspace_users.” Online therapy provider Headspace previously had an $82,500 federal contract with ICE that ended in 2023 to fund “mental health software required for ERO employees,” a reference to ICE’s deportation unit. A spokesperson for Headspace said the company has not provided any services to DHS or ICE since 2023.

数据集中的大多数国土安全部员工都是有权访问 Microsoft 365（托管该机构电子邮件和文件的云服务）的用户组成员，以及访问 Adobe Acrobat、Citrix 和其他典型桌面软件的用户组成员。数据还显示，约 4500 名用户（包括 ICE 特工和驱逐官员）是一个名为“Headspace_users”组的成员。在线治疗提供商 Headspace 此前曾与 ICE 签订了一份价值 8.25 万美元的联邦合同，该合同于 2023 年结束，旨在资助“ERO 员工所需的心理健康软件”（指 ICE 的驱逐部门）。Headspace 发言人表示，自 2023 年以来，该公司未向国土安全部或 ICE 提供任何服务。

Dozens of other user groups reference Penlink, a web surveillance company that makes technology it claims can track the location data of hundreds of millions of mobile devices. Penlink has had a contract with ICE for years. The user groups vary in size, from a handful of users in local Homeland Security offices around the country to more than 2,000 users across ICE’s HSI unit nationally. One group specifically references Penlink PLX, which the company says is used to capture and analyze “real-time intelligence” from phone calls, texts, web activity, and social media. A spokesperson for Penlink did not respond to a request for comment. One user group also includes more than 200 CBP users associated with Mobile Fortify, a facial-recognition app used by both CBP and ICE agents to identify people and verify their i

其他数十个用户组提到了 Penlink，这是一家网络监控公司，其制造的技术声称可以追踪数亿台移动设备的位置数据。Penlink 多年来一直与 ICE 有合同关系。这些用户组规模不等，从全国各地国土安全部地方办公室的少数用户到 ICE 全国 HSI 部门的 2000 多名用户。其中一个组专门提到了 Penlink PLX，该公司称该系统用于从电话、短信、网络活动和社交媒体中捕获和分析“实时情报”。Penlink 发言人没有回应置评请求。还有一个用户组包括 200 多名与 Mobile Fortify 相关的 CBP 用户，这是一款由 CBP 和 ICE 特工用于识别人员并验证其身份的面部识别应用程序。