The Department of Homeland Security told employees on Thursday that it was aware of a “potential breach” and working to address the situation, a day after an activist group that publishes leaks released data on more than 41,000 workers at the department.
“The safety, security and privacy of our employees, officers, and their families remains a top priority,” Roman Jankowski, the department’s chief privacy officer, said in an email that was reviewed by The New York Times. “DHS leadership and component leaders are working to understand the scope of the situation, assess potential threats, and identify appropriate resources and protective measures.”
The organization behind the leak said it released identifying information about employees to promote transparency about the “key personnel” involved with the department’s deportation campaign, a pillar of President Trump’s policy agenda.
The leak immediately raised concerns among workers who wanted to know how the department would help protect their privacy. The released information did not appear to include home addresses or personal emails, but several workers said they worried about being identified publicly and associated with the president’s immigration crackdown.
It also prompted questions about how the leak could affect ongoing investigations, in part because the group said it released information that identified officials overseeing undercover operations. The department has focused on immigration enforcement under Mr. Trump, but it also has a broader mandate to protect the country from national security threats and investigate transnational crimes like human trafficking.
The data was obtained by a group that calls itself the Department of Peace, which shared the data with a nonprofit known as the Distributed Denial of Secrets. The nonprofit, which for years has released leaks of government and other data it believes are in the public interest, published a searchable database that includes D.H.S. employee names, offices, mobile phone numbers, work emails and assignments.
Six employees who were listed in the database and contacted by The Times confirmed that the information released about them was accurate. Some employees, who requested anonymity because they were not authorized to speak publicly, said they were concerned for their safety and did not want to be targeted because they appeared to be participating in the administration’s deportation campaign.
Others said the leak included their office locations and work phone numbers instead of more personal information, so they were less concerned about the repercussions.
In a statement, the Department of Homeland Security said it took “all security threats against our employees and officers seriously,” and it would update the public when more information was available. The leak affected about 15 percent of the department’s more than 260,000 employees.
The theft and disclosure of D.H.S. employees’ data is at least the third compromise of sensitive U.S. government personnel information in a little over a month.
In September, a criminal hacking group called ShinyHunters revealed it had hacked a hiring portal used by the F.B.I. that contained reams of sensitive information on thousands of current and former officials, including home addresses, job assignments, medical records, Social Security numbers and more. Officials and cybersecurity experts have said the hack could have potentially devastating consequences for the bureau.
Around the same time, the Pentagon disclosed that personnel data on about three million current and former military officials had been exposed because of a misconfigured file-transfer system. The exposed unencrypted data — which included names, birth dates, demographic details and some information about military service — was left accessible online for roughly nine months until it was discovered and secured this summer. The database was infiltrated by an unknown number of unauthorized people, though it is not clear who gained access. Two Marines filed a class-action lawsuit against the Pentagon this month seeking millions in damages on behalf of those whose information was exposed.
Compromises of private personal information belonging to employees or customers is a fact of life in the digital age. But while businesses routinely suffer such breaches, the recent thefts of federal government records have occurred at an alarming rate.
The D.H.S. leak is different from both the F.B.I. hack and the Pentagon data exposure, however, because the details have been published online and are easily available for anyone to gain access to and sift through.
“This is loud, ideological hacktivism,” said Ben Bernstein, a security adviser at the U.S.-based cybersecurity company Huntress, referring to the political motivations of the D.H.S. leak. The episode did not appear to present national security concerns akin to some other breaches, he said, but victims could see physical safety risks or targeting phishing from hackers as a result.
“Having 40,000 D.H.S. employee records exposed is undeniably serious,” he said.
