The US Department of Homeland Security has asked an Icelandic web‑hosting provider to remove or restrict access to a database containing personal details of more than 40,000 of its staff, warning that the exposure leaves them vulnerable to harassment, stalking and physical danger.
Scope of the breach
The leaked dataset, published by DDoSecrets and a searchable archive by hacker‑journalist maia arson crimew, contains names, work addresses and telephone numbers of agency personnel.
Government response
In a formal request posted on FlokiNET’s site, DHS warned that the information “places more than 40,000 identifiable individuals at risk of harassment, stalking and physical harm.” The agency’s ZeroFox liaison, acting on behalf of ICE, cited the same figure in an email urging the host to act swiftly. A DHS spokesperson said the department is aware of the potential breach and is working to address it rapidly, emphasizing that the safety of its officers and employees remains a top priority at the centre of DHS operations. The request does not ask for the deletion of personal phone numbers or home addresses, only for the removal of work‑related contact details that could be exploited.
Privacy concerns and activist reaction
Privacy advocates have long criticised DHS for pulling data from other government programmes, such as Medicaid records and tax filings, to support immigration enforcement. The activist collective known as “the Department of Peace” claimed responsibility for the hack, arguing that public officials should have their information exposed in return for the data they hold. While the group says the release is meant to curb further harm caused by DHS operations, critics warn that publishing work details could endanger staff and undermine national security. The episode highlights a growing tension between transparency demands and the protection of personal safety within public agencies.
Why it Matters
The fallout from this leak could reshape how federal agencies manage employee data and influence future legislation on cyber‑security safeguards. If the host complies, it may set a
