US officials downplay impact of Department of Justice hacking

US officials have downplayed the impact of the latest hack of government data, this one containing employee information from 29,000 Department of Justice (DoJ) and Homeland Security (DHS) staff.

Hackers claimed Sunday night to have stolen sensitive information from some 20,000 people employed by DoJ, including Federal Bureau of Investigation officials, and another 9,000 from DHS. But government sources familiar with the hack said the compromised information paled by comparison to the recent data theft from the Office of Personnel Management (OPM).

“The department is looking into the unauthorized access of a system operated by one of its components containing employee contact information,” DOJ spokesman Peter Carr told the Guardian. “This unauthorized access is still under investigation; however, there is no indication at this time that there is any breach of sensitive personally identifiable information. The department takes this very seriously and is continuing to deploy protection and defensive measures to safeguard information. Any activity that is determined to be criminal in nature will be referred to law enforcement for investigation.”

Hacked data posted anonymously on an encrypted website and reviewed by the Guardian included a DHS personnel directory. The information listed included phone numbers and email addresses for individuals who have not worked for DHS in years. Some listings included long-outdated titles.

The encrypted DHS directory appeared online just before 7pm EDT on Sunday. The password was “lol”.

A person claiming responsibility told Motherboard, which broke the story of the hack, that he or she had compromised a DHS employee’s account and then used the information from it to convince an FBI phone operator to provide access to the DoJ’s computer system.

Hackers promised to release information from the DoJ on Monday, and at 4pm EDT a similar list was posted on the same site, with a DoJ staff directory that also appeared to be somewhat out of date. That list also appeared geniune and included working phone numbers for some DoJ staff.

During a government-wide meeting Monday morning to assess the hack, an official likened it to stealing a years-old AT&T phone book after the telecom had already digitized most of its data. But knowledgeable officials admit that it should be less simple to obtain an access token by impersonating an official from a different department over the phone to a help desk.

“The bottom line is, something broke,” an official said.

Things break regularly in government data security. The OPM hack, revealed in June, exposed the deeply researched security clearances of 21.5m current and former government employees and contractors, from phone numbers to fingerprints. Though the DHS breach appears far less severe, it is nevertheless particularly embarrassing given that the department has been designated the point of entry for all corporate data shared with government agencies in the controversial information sharing program between industry and government created by the Cybersecurity Information Sharing Act last year.

The program, in which private companies share user information with the government in exchange for immunity from regulation, was unpopular from its inception at the DHS, which is left holding the bag in the event of a breach. DHS deputy secretary Alejandro Mayorkas quoted troubling provisions from the bill in a letter to Senator Al Franken sent in July: “The authorization to share cyber threat indicators and defensive measures with ‘any other entity or the Federal Government,’ ‘notwithstanding any other provision of law’ could sweep away important privacy protections,” he wrote.

Information for Mayorkas, who has been at DHS since 2013, could not be found in the directory leaked on Sunday.

Through a Twitter account apparently used by several people, the person or people responsible for the DHS breach posted a link to an encrypted page with more than 9,300 names, phone numbers, titles and email addresses from the Department of Homeland Security. Jeh Johnson, head of the DHS, was the victim of a hack last year, as was John O Brennan, head of the CIA. The account also posted two screenshots of a web browser logged into a DoJ computer.

The perpetrators of more than one recent hack, including this one, say they’re acting out of sympathy for Palestine: the hashtag #FreePalestine has appeared alongside several hacks in the last few months, and the DHS staff directory is prefaced with a quote from English rapper Lowkey: “This is for Palestine, Ramallah, West Bank, Gaza, This is for the child that is searching for an answer.”