On October 28, an activist group published a searchable list of more than 40,000 people who work for or with the U.S. Department of Homeland Security. The group says it got in through the single sign-on system DHS employees use to log in. You don’t need to be a federal agency to learn from this one.
At a glance
- Who: about 41,000 DHS employees and contractors, including immigration and border officers
- What leaked: names, job titles, work contact details, login records and which internal systems each person can use
- How, per the group: through Okta, the single sign-on service DHS staff use to log in
- Status: DHS says it is aware of a potential breach and is working to address it
- The lesson: the account that unlocks everything needs the strongest protection you have
What happened
A group calling itself “Department of Peace” handed a large set of DHS personnel records to the nonprofit Distributed Denial of Secrets, which published them on October 28. The group says it got the data earlier this year by getting into Okta, the service DHS uses so employees can sign in once and reach many internal systems.
News outlets including CNN and TechCrunch reviewed the data and say at least part of it appears to be real, though incomplete. According to CNN, a source said some undercover personnel were exposed. DHS has not said how the attackers got in, and the investigation is ongoing. This also comes a few months after a separate breach of a DHS information-sharing network, first reported in July.
Why single sign-on matters here
Single sign-on (SSO) is the “log in once” button many businesses now use with Microsoft 365, Google Workspace, Okta and similar services. It’s convenient and, set up well, it’s more secure than a pile of separate passwords. But it also means one account can open email, files, accounting and everything else.
That makes the sign-on system a master key. If an attacker gets it, they don’t need to break into each system one by one. And as this leak shows, even a list of who has access to what is valuable. It tells criminals exactly whom to target next.
What a small business should take from this
- Turn on two-step login everywhere, starting with your main account. An app prompt, passkey or security key is far stronger than a text message code.
- Give people only the access they need. The office manager doesn’t need the server admin login. Fewer keys means less to lose.
- Remove access the day someone leaves. Old accounts that still work are one of the most common ways in.
- Take login alerts seriously. “New sign-in from an unknown device” emails are easy to ignore. Read them, and ask about the ones you don’t recognize.
- Expect fake “government” emails. Leaks like this fuel convincing phishing. Before you click a link about SAM.gov, the IRS or any agency, go to the site by typing its address yourself.
The bottom line
Single sign-on isn’t the problem. An unprotected master key is. If you’re not sure how your business logins are set up, or whether two-step login is really on for everyone, High Definition Technologies can review it with you and close the gaps.
Sources: TechCrunch, CNN, CyberScoop, NBC News.
Comments
Join the HDT community to add comments
Enter your name and email and we’ll send you a sign-in link. No password needed. You’ll also get an email when we publish a new post, and you can unsubscribe anytime.