Motherboard are reporting that the hacker who claimed to be planning to leak information on thousands of US government workers has made good on his threat. Data pertaining to approximately 20,000 employees of the Federal Bureau of Investigation and 9,000 employees of the Department of Homeland Security was leaked online and shared with Motherboard.
The leaked data, which includes names, titles, and contact information, does not contain any credit card or financial information and is a lot smaller than the 1TB of information to which the hacker claims to have access. As such, it appears that the leak is being downplayed, with a spokesperson for the Department of Justice being reported as saying that ‘there is no breach of any personally identifiable information’.
However, at the same time, the manner in which the breach is alleged to have been executed is concerning. Though it is not clear how this was achieved, reports suggest that the hacker first compromised the email account of a Department of Justice employee. With this email account, the hacker was unable to access a web portal, so he simply called the relevant department and ‘socially engineered’ his way in. Pretending to be a new employee, the hacker was given an access token which allowed him to access a virtual machine, from which he then exfiltrated the leaked data. Overall, this breach paints a disturbing picture of cybersecurity culture at a high level.