字号·· | 护眼
加拿大广播公司

4万名美国国土安全部员工个人数据在安全泄露事件中外泄Personal data of 40,000 U.S. Homeland Security employees leaked in security breach

点「原文对照」整页切到原文,或双击某段只看那段的原文。

美国国土安全部的印章出现在2021年的一场新闻发布会上。作为网络安全漏洞事件的一部分,4万名国土安全部员工的个人数据遭到泄露。(马尔科·贝洛/路透社)The seal of the U.S. Department of Homeland Security is seen at a 2021 news conference. The personal data of 40,000 DHS employees has been leaked as part of a cybersecurity breach. (Marco Bello/Reuters)

泄密网站“分布式拒绝服务秘密”(Distributed Denial of Secrets)周三表示,已发布超过4万名美国国土安全部(DHS)员工的数据,其中包括从事监视和人力情报等敏感领域工作的官员详细信息。

The leak website Distributed Denial of Secrets said on Wednesday it has released data on more than 40,000 U.S. Department of Homeland Security (DHS) employees, including details about officials working in sensitive fields such as surveillance and human intelligence.

国土安全部在一份声明中表示,该部门“知悉潜在的数据泄露,正积极努力迅速有效地处理事态”。该部门称,正在努力确保其员工得到妥善保护,并将在“获得更多信息时”向公众通报情况。这家非营利数据透明化组织表示,此次披露的信息源自一个自称“和平部”(Department of Peace)的实体获取的资料,这是过去一个月内登上头条的第三起重大政府数据泄露事件。

DHS said in a statement it was "aware of a potential breach and is actively working to address the situation swiftly and effectively." The agency said it was working to ensure its employees were properly protected and would update the public "when more information is available.”The disclosure — which the non-profit data transparency group says draws on information obtained by an entity calling itself "Department of Peace" — is the third major government data leak to have made headlines in the past month.

9月,黑客组织“闪亮猎手”(ShinyHunters)声称窃取了联邦调查局(FBI)的海量数据,包括数千名局员工的敏感职务详情和医疗信息。上周,美国战争部(U.S. War Department)因一起泄露数百万现役和前军事人员数据的事件,面临集体诉讼。

In September, the hacking group ShinyHunters claimed the theft of a massive trove of data from the Federal Bureau of Investigation (FBI), including sensitive job details and medical information from thousands of bureau employees. Last week, the U.S. War Department was hit with a class-action lawsuit following a breach that exposed data on millions of current and former military personnel.

“闪亮猎手”黑客称不会泄露敏感FBI数据 荷兰警方在“闪亮猎手”调查中逮捕一名安全专业人员 国土安全部的数据包括移民与海关执法局(ICE)、海关与边境保卫局(CBP)、国土安全调查局(HSI)、网络安全和基础设施安全局(CISA)及其他国土安全部下属机构员工的姓名、电话号码和电子邮件地址。

ShinyHunters hackers say they won't leak sensitive FBI data Dutch police arrest security professional in ShinyHunters investigation The DHS data includes names, phone numbers and email addresses of employees from Immigration and Customs Enforcement, Customs and Border Protection, Homeland Security Investigations, the Cybersecurity and Infrastructure Security Agency, and other DHS component agencies.

数据中还包含职务名称和电子邮件组,除其他细节外,这些信息显示了哪些特工被分配到特种行动、监视工作、计算机取证和卧底工作。

Also included in the data were job titles and email groups, which, among other details, showed which agents were assigned to special operations, surveillance jobs, computer forensics and undercover work.

分布式拒绝保密组织联合创始人艾玛·贝斯特在一份声明中表示,化名“玛雅·阿尔森·克赖姆”的黑客活动分子为这些数据开发了一个搜索工具,让公众可以浏览。贝斯特表示,该工具将“用问责取代匿名”,为记者赋权,指导公共记录请求,并加强国会监督。

In a statement, Distributed Denial of Secrets co-founder Emma Best said the hacktivist known as "maia arson crimew" developed a search tool for the data that would allow the public to browse it. Best said the tool would "replace anonymity with accountability" and empower journalists, guide public records requests and boost congressional oversight.

和平部没有立即回应置评请求,但在随数据一并发布的声明中表示,国土安全部员工“掌握了我们的信息,所以我们掌握他们的信息才是公平的”,并希望这些数据“能够被用来限制国土安全部造成进一步伤害,并支持朝这一方向所作的一切努力”。和平部今年3月声称对入侵国土安全部及发布与外部供应商合同有关的文件负责。

The Department of Peace did not immediately respond to a request for comment, but in a statement included with the data it said that DHS employees "have our information, so it's only fair that we have theirs" and that it hoped the data "can be used to limit further harm by the DHS and supports all efforts in that direction." The Department of Peace in March claimed responsibility for hacking DHS and posting documents related to contracts with outside vendors.

贝斯特的声明称,和平部从国土安全部使用的 Okta 登录服务获取了这些数据。路透社无法立即证实这一说法。Okta 在回应路透社的询问时表示:“Okta 是安全的,我们没有证据表明我们的数据或系统受到损害。”路透社无法立即核实整个数据集的真实性,但能将泄密文件中提到的六名国土安全部员工的个人信息,与征信机构记录以及暗网情报平台 District 4 Labs 收录的泄露数据进行比对。

Best's statement said the Department of Peace harvested the data from the Okta sign-on service used by DHS. Reuters could not immediately corroborate the claim. Okta said in response to a Reuters query: "Okta is secure, and we have no evidence our data or systems were compromised." Reuters could not immediately verify the authenticity of the entire data trove but it was able to match personal information about six DHS employees named in the leak to credit bureau records and breach data carried by the dark web intelligence platform District 4 Labs.

路透社直接致电了三名国土安全部员工,确认了他们的电话号码和其他细节。其中一人表示,这是他们第一次听说发生数据泄露。

Reuters called three DHS employees directly and was able to confirm their phone numbers and other details. One said it was the first they had heard of a breach.

在某些情况下,这些数据与国土安全部员工的领英个人资料中公开的信息相符。但在其他情况下,数据揭示了国土安全部内部组织架构的非公开数据,或此前未披露的项目或行动。

In several cases, the data tracked information available on DHS employees' LinkedIn profiles. But in others, the data revealed non-public data about internal DHS organization charts or previously undisclosed programs or operations.

阅读媒体原文 ↗