US Homeland Security cites risk to over 40,000 personnel in effort to take leaked data offline

​The US Department of Homeland Security asked ​an Icelandic hosting company on ‌Thursday to ​take down or limit access to data related to thousands of agency personnel, saying the content put them at risk, according ‌to the request posted online by hosting company FlokiNET. The database “places more than 40,000 identifiable individuals at risk of harassment, stalking, and physical harm,” the request said.

ZeroFox, a company authorized by the US Immigration ‌and Customs Enforcement agency to pursue content removal actions, cited the figure in an email ‌to FlokiNET. FlokiNET CEO Kolja Weber told Reuters that his company would not remove the DHS data because it included government employee work addresses and work phone numbers, not personal phone numbers and addresses.

A DHS spokesperson said the ⁠agency “is aware ​of a potential breach ⁠and is actively working to address the situation swiftly and effectively. We take all security threats against our employees ⁠and officers seriously and will work to ensure all are properly protected.” Nonprofit data transparency group DDoSecrets released ​data on more than 40,000 DHS personnel on its website on Wednesday, alongside a separate, ⁠searchable database developed by hacker and journalist "maia arson crimew." The database was briefly inaccessible on Thursday but was soon republished ⁠at ​a different domain.

A group calling itself "Department of Peace" claimed responsibility for obtaining the data, and said in a statement on Wednesday that DHS employees "have our information, so it's only fair ⁠that we have theirs" and that it hoped the data "can be used to limit further harm ⁠by the DHS ⁠and supports all efforts in that direction." Privacy advocates have criticized DHS' use of personal data from other agencies, including Medicaid records and taxpayer data, for ‌immigration enforcement.