The Department of Homeland Security (DHS) is responding to a potential breach after a group published records identifying more than 41,000 employees and contractors, while a separate watchdog report found sensitive General Services Administration (GSA) documents had been shared too broadly inside the agency.
The unrelated incidents – disclosed on Oct. 28 and Oct. 27, respectively – highlight different risks to federal information security. The DHS incident raises concerns about employee safety and operational security, while the GSA findings point to weaknesses in internal data access controls.
DHS investigates release of personnel records
Distributed Denial of Secrets (DDoSecrets) published the DHS data in an archive it called Icepick. The organization said the records identify employees’ names, offices, contact information, and assignments, and were supplied by a group calling itself the Department of Peace.
DDoSecrets said the data was accessed via an Okta single sign-on service used by DHS. That account of how the information was obtained remains unconfirmed.
An Okta spokesperson told MeriTalk it was aware if the breach but had no evidence that its own data or systems had been compromised.
“Okta is secure, and we have no evidence our data or systems were compromised,” the spokesperson said.
In a statement to MeriTalk, DHS acknowledged the potential breach and said it was working to address the situation.
“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a spokesperson for the agency said. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”
DDoSecrets described the release of the DHS data as a resource for investigating the department and identifying officials responsible for policy and operations, including oversight of covert and undercover activities.
GSA inspector general finds gaps in protection of sensitive information
An Oct. 27 report from the GSA inspector general identified 116 documents containing controlled unclassified information improperly shared with all GSA users. They included building security plans, personal information, and proprietary vendor material.
Auditors cited weaknesses in oversight of a data loss prevention tool, including incomplete reviews of search terms and a 15-megabyte scanning limit.
GSA said its review found no external exposure or indication of malicious intent. The watchdog recommended restricting access to the 116 documents, finding other improperly shared files, notifying affected individuals, and improving controls. In an Oct. 5 response included in the report, GSA Chief Information Officer David Shive agreed with the recommendations.
“While this audit was underway, GSA IT took significant corrective actions to strengthen the protection of sensitive information across GSA’s Google Workspace,” Shive said in his response.
Cyber expert warns of risks beyond initial exposure
When sensitive personnel information is exposed, as in the DHS breach, the response “needs to address employee safety and operational security alongside technical containment,” said Alissa Knight, CEO of Assail and Assail Federal, a Boston-based cybersecurity company.
She told MeriTalk that connecting someone’s identity to their job, contact information, and operational role gives an adversary a targeting map.
“It can make impersonation more convincing, expose sensitive personnel, and create risks that extend beyond the network,” Knight said.
Closing the access path, she said, is only part of the response.
“Once personnel information is public, affected employees need clear guidance and sustained protection against targeted phishing, impersonation, and other follow-on threats. You can revoke a session. You cannot revoke someone’s identity,” Knight said.
She also said investigators must also separate the attackers’ claims from established facts.
“A claim that the data came through Okta or single sign-on is not a forensic conclusion. Investigators need to establish which account, session, or application was used, what it could access, and how the information left the environment,” Knight said.
For other agencies, she said, the question is straightforward: How much sensitive information could one compromised identity expose?
“Phishing-resistant authentication, tightly scoped permissions, and monitoring for unusual access and bulk extraction all matter. But those controls must be tested together against realistic attack paths. A control being enabled is not the same as proving it stops an adversary,” she said.