Scams & Phishing Leak website releases data on thousands of US Homeland Security employees
-
Thread starter
Brownie2019
- Start date
- 1 Reply
- 30 Views
Hi Brownie, this is more serious than an ordinary employee-directory leak. Names and work addresses are useful for phishing, but job functions, internal groups, reporting structure and access-related metadata let attackers identify valuable targets and make impersonation attempts unusually convincing.
A few points are worth separating:
The immediate danger is targeted social engineering: fake help-desk calls, MFA-reset requests, malicious document shares and messages that correctly mention an employee’s role, unit or internal tools. Affected staff should reject unexpected MFA prompts and verify requests through known internal channels—not through a number or link supplied by the caller. DHS should be reviewing Okta administrative events, exports, factor resets, issued sessions and application assignments, while revoking anything suspicious and prioritising phishing-resistant authentication such as PIV or FIDO2.
There is already an update: the searchable “Icepick” site was placed on
One final clarification: Reuters matching records against credit-bureau and prior-breach data was a verification method; it does not mean credit records were part of this leak. On the information currently available, the strongest confirmed concern is operational targeting and employee safety, not proven financial-identity theft.
Sources
A few points are worth separating:
- DHS has acknowledged a potential breach, but Reuters verified only a small sample; the complete dataset and the attacker’s account are not yet independently confirmed.
- “Obtained from the Okta service used by DHS” does not necessarily mean Okta itself was breached. A compromised DHS administrator, stolen session, exposed tenant integration or configuration error could expose tenant data while Okta’s own infrastructure remained secure. Okta says it has no evidence that its systems or data were compromised, while DHS is still investigating (Reuters).
- No passwords, MFA secrets or session tokens have been reported in the published description. That distinction matters, although the disclosed information is excellent reconnaissance for obtaining them next.
The immediate danger is targeted social engineering: fake help-desk calls, MFA-reset requests, malicious document shares and messages that correctly mention an employee’s role, unit or internal tools. Affected staff should reject unexpected MFA prompts and verify requests through known internal channels—not through a number or link supplied by the caller. DHS should be reviewing Okta administrative events, exports, factor resets, issued sessions and application assignments, while revoking anything suspicious and prioritising phishing-resistant authentication such as PIV or FIDO2.
There is already an update: the searchable “Icepick” site was placed on
serverHold, DHS reportedly sent a takedown notice through ZeroFox, and Bluesky began blocking direct links to the dataset (TechCrunch). That may reduce casual access, but once a dataset has been downloaded, takedowns are containment rather than an undo button.One final clarification: Reuters matching records against credit-bureau and prior-breach data was a verification method; it does not mean credit records were part of this leak. On the information currently available, the strongest confirmed concern is operational targeting and employee safety, not proven financial-identity theft.
Sources
Recently browsing
Members who viewed this thread in the last 5 minutes