数千名美国国土安全部员工的个人身份信息已被发布在网上，此前一名黑客在今年早些时候窃取了大量数据，该部门此前未曾披露此次泄露事件。
Personally identifiable information belonging to thousands of U.S. Department of Homeland Security employees has been published online after a hacker stole reams of data in a previously undisclosed breach at the government department earlier this year.
此次泄露涉及在该联邦部门工作的超过 4 万人的姓名、职称和工作联系信息，如电子邮件地址、手机号码和办公地点，其中包括边境和移民执法人员、网络安全工作人员以及部门高级官员。
The breach includes names, job titles, and work contact information, such as email addresses, cell phone numbers, and office locations, of more than 40,000 people who work for the federal department, including border and immigration agents, cybersecurity staffers, and senior department officials.
一名自称“和平部”的黑客声称，他们从国土安全部使用的 Okta 单点登录系统中获取了这些数据，该系统允许员工和承包商跨各机构访问其中央网络。该 Okta 系统还包含与员工用户账户相关的 IT 和记录，包括他们被允许访问哪些系统和内部应用程序的详细信息。
A hacker who goes by the handle Department of Peace claimed they obtained the data from an Okta single sign-on system used by Homeland Security to allow employees and contractors across its various agencies toto its central network. The Okta system also contains IT and records associated with the employees’ user account, including details about which systems and internal apps they are permitted to access.
数据集中超过一半——约 2.1 万条记录——与美国海关及边境保卫局（CBP）员工有关，他们在机场和其他入境口岸工作。
More than half of the dataset — some 21,000 records — relate to employees with U.S. Customs and Border Protection (CBP), who work at airports and other ports of entry.
数据还包含与另外 1 万名美国移民及海关执法局（ICE）及其国土安全调查局（HSI）员工相关的记录，以及近 1000 名在国土安全部网络安全防御机构 CISA 工作的员工记录。
The data also contains records associated with another 10,000 employees of Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) unit, and just under a 1,000 employees who work at U.S. cybersecurity defense agency CISA.
数千条额外记录涉及在该部门总部及其其他机构工作的员工，包括美国公民及移民服务局和联邦保卫局。
Thousands of additional records relate to staff who work at the department’s headquarters and its other agencies, including U.S. Citizenship and Immigration Services and the Federal Protective Service.
“他们掌握了我们的信息，所以我们掌握他们的信息才公平，”“和平部”在随数据留下的说明中写道，《科技博客》（TechCrunch）已查看该说明。该黑客未回复《科技博客》发送的请求置评邮件及关于泄露如何实施的提问。
“They have our information, so it’s only fair that we have theirs,” said Department of Peace in a note left with the data, which TechCrunch has seen. The hacker did not respond to TechCrunch’s email requesting comment and with questions about how the breach was carried out.
这是近几个月来袭击美国政府的最新数据泄露事件，此前曾发生过黑客窃取数千名FBI特工人事档案以及五角大楼人力资源部门数百万现役和退役军人个人信息的入侵事件。这也是今年涉及国土安全部的第二起泄露事件，此前同一名黑客声称窃取了该部门与私营部门（包括国防承包商和监控供应商）签订的数千份合同。
This is the latest data breach to hit the U.S. government in recent months, following earlier hacks involving the theft of thousands of FBI agents’ personnel records and the personal information of millions of serving and former military service personnel from the Pentagon’s human resources unit. It’s also the second breach involving Homeland Security this year, after the same hacker claimed to have taken thousands of contracts between the department and the private sector, including defense contractors and surveillance vendors.
最新泄露的这批数据看起来是真实的，提供了一个罕见的——尽管不完整的——窗口，让人得以窥见国土安全部的规模和运作。在即将到来的美国中期选举前夕，该部门在其领导下实施的驱逐出境、任意拘留以及杀害美国公民的行为，已成为选民关注的关键议题。
The latest batch of breached data, which appears authentic, offers a rare — albeit incomplete — view into the scale and operations of Homeland Security, whose deportations, arbitrary detentions, and killings of U.S. citizens under its leadership have become a key issue for voters ahead of the upcoming U.S. midterm elections.
被盗的国土安全部数据被提供给了记者兼黑客玛雅·纵火·克里缪（maia arson crimew），后者随后与DDoSecrets分享了一份副本。DDoSecrets是一个非营利性团体，出于公共利益托管泄露的数据集。
The stolen Homeland Security data was provided to journalist and hacker, maia arson crimew, who then shared a copy with DDoSecrets, a nonprofit collective that hosts leaked datasets in the public interest.
TechCrunch通过将多名已知国土安全部员工的姓名与数据库的离线副本进行比对，验证了部分数据的真实性。根据每个人记录上的时间戳，数千条员工名录记录似乎是在8月中旬前后被窃取的。泄露记录的数量大约相当于国土安全部员工总数的五分之一，该部门共有约22万名员工。
TechCrunch verified a portion of the data as authentic by matching the names of several known Homeland Security employees against an offline copy of the database. The thousands of employee directory records appear to have been exfiltrated around mid-August, according to the timestamps on each person’s record. The number of leaked records is equivalent to about one-fifth of Homeland Security’s workforce, which totals around 220,000 staff.
目前尚不清楚导致此次泄露的漏洞是否已被修复，也不清楚国土安全部是否知晓此次数据窃取事件。
It’s unclear whether the vulnerability that allowed the breach has been fixed or if Homeland Security is aware of the data theft.
国土安全部发言人没有立即回应TechCrunch就此次泄露事件提出的置评请求。
A spokesperson for Homeland Security did not immediately respond to TechCrunch’s request for comment about the breach.
Okta在回应置评请求时表示，已获悉这一报道。一位发言人说：“Okta是安全的，我们没有证据表明我们的数据或系统遭到入侵。”
When reached, Okta said it was aware of this report. “Okta is secure, and we have no evidence our data or systems were compromised,” a spokesperson said.
尽管泄露的数据包含特工和官员的可识别信息，但该数据集还揭示了国土安全部员工可能能够访问的更多监控技术和网络安全工具。批评人士呼吁对资助或向移民及海关执法局提供技术的科技公司进行调查。
While the leaked data includes identifiable information about agents and officers, the dataset also reveals more about the surveillance technologies and cybersecurity tools that Homeland Security employees may be able to access. Critics have called for investigations into tech companies that fund or provide their technology to ICE.
泄露的数据包含员工在国土安全部Active Directory内用户组成员身份的信息。Active Directory是一个控制系统，用于管理对部门内部工具、服务以及工作所用第三方产品的访问权限。
The leaked data contains information about employees’ membership in user groups within the department’s Active Directory, a system that controls access to the department’s internal tools, services, and third-party offerings used for work.
数据集中大多数国土安全部员工属于可访问Microsoft 365的用户组——这是这家科技巨头的云服务，托管着该机构的电子邮件和文件——此外还有访问Adobe Acrobat、Citrix及其他常见桌面软件的用户组。
Most of the Homeland Security employees in the dataset were members of the user group that had access to Microsoft 365, the tech giant’s cloud service that hosts the agency’s emails and files, as well as user groups for accessing Adobe Acrobat, Citrix, and other typical desktop software.
数据还显示，约4500名用户（包括移民及海关执法局特工和遣返官员）属于一个名为“Headspace_users”的群组。在线心理治疗服务提供商Headspace此前与移民及海关执法局有一份价值82500美元的联邦合同，该合同已于2023年结束，用于资助“执法与遣返行动部门员工所需的心理健康软件”——执法与遣返行动部门指的是移民及海关执法局的遣返部门。
The data also shows that around 4,500 users, including ICE agents and deportation officers, are members of a group called “Headspace_users.”Online therapy provider Headspace previously had an $82,500 federal contract with ICE that ended in 2023 to fund “mental health software required for ERO employees,” a reference to ICE’s deportation unit.
Headspace的一位发言人表示，该公司自2023年以来未向国土安全部或移民及海关执法局提供任何服务。
A spokesperson for Headspace said the company has not provided any services to DHS or ICE since 2023.
另有数十个用户组提及Penlink，这是一家网络监控公司，其声称所制造的技术可以追踪数亿部移动设备的位置数据。Penlink与移民及海关执法局已签订合同多年。这些用户组规模不一，从全国各地国土安全部地方办公室的少数用户，到移民及海关执法局国土安全调查部门全国范围内超过2000名用户。其中一个用户组专门提及Penlink PLX，该公司称该产品用于从电话通话、短信、网络活动和社交媒体中捕获并分析“实时情报”。Penlink的一位发言人未回应置评请求。
Dozens of other user groups reference Penlink, a web surveillance company that makes technology it claims can track the location data of hundreds of millions of mobile devices.”Penlink has had a contract with ICE for years. The user groups vary in size, from a handful of users in local Homeland Security offices around the country to more than 2,000 users across ICE’s HSI unit nationally. One group specifically references Penlink PLX, which the company says is used to capture and analyze “real-time intelligence” from phone calls, texts, web activity, and social media. A spokesperson for Penlink did not respond to a request for comment.
其中一个用户群还包括200多名与Mobile Fortify相关的美国海关与边境保护局用户。Mobile Fortify是一款面部识别应用，海关与边境保护局和移民与海关执法局的特工都用它来识别人员并核实其信息和移民身份。
One user group also includes more than 200 CBP users associated with Mobile Fortify, a facial recognition app used by both CBP and ICE agents to identify people and verify their information and immigration status.
这些用户群还包括若干与ChatGPT访问权限相关的员工，其中包括国土安全部高级官员，以及其他与调查名为“盐台风”和“伏特台风”的中国支持黑客组织相关的群组。
The user groups also include several employees associated with ChatGPT access, including senior DHS officials, as well as other groups associated with investigations into the China-backed hacking groups known as Salt Typhoon and Volt Typhoon.
研究人员和公共信息倡导者表示，泄露的数据可能为调查特朗普政府涉嫌滥权行为提供有价值的线索，例如可以识别出特工的电子邮件地址，用于依据《信息自由法》提出公共记录请求。
Researchers and public information advocates say that the exposed data could provide valuable leads for investigations into alleged abuses by the Trump administration, such as identifying email addresses of agents that can be used in public records requests under the Freedom of Information Act.
“电子邮件地址和电话号码是《信息自由法》研究人员不可或缺的工具，往往决定了一份含糊的记录请求是被敷衍搪塞还是能取得结果，”透明度非营利组织“人民财产”执行主任瑞安·夏皮罗说。
“Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results,” said Ryan Shapiro, the executive director of transparency nonprofit Property of the People.
“鉴于特朗普政府对哪怕最基本的透明度都嗤之以鼻，对此类工具的需求十分迫切，”夏皮罗说。
“Given the Trump administration’s contempt for even basic transparency, the need for such tools is urgent,” said Shapiro.
DDoSecrets联合创始人、记者艾玛·贝斯特表示，泄露的国土安全部数据将成为“调查的催化剂，为记者、国会调查、法律挑战、社区行动和《信息自由法》请求赋能”。
DDoSecrets co-founder and journalist Emma Best said that the exposed Homeland Security data will be a “catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests.”