Hacker claims breach of Acuity federal contractor, selling immigration agencies data
Learn More
The hacker identity IntelBroker claims to have breached Acuity Inc., a federal contractor based in Reston, Virginia, specifically targeting sensitive data belonging to U.S. Immigration and Customs Enforcement (ICE) and U.S. Citizenship and Immigration Services (USCIS).
Acuity Inc. is recognized for its federal technology consulting services, offering expertise mainly to agencies related to National Security and Public Safety, with a mission focused on leveraging innovative technology solutions to enhance agency capabilities.
The claim was posted on Breach Forums, where IntelBroker offers the data for sale for $3,000 in Monero (XMR) cryptocurrency. The breach has been confirmed by Hackread.com and reports that the data for sale includes personal and Personally Identifiable Information (PII) of over 100,000 individuals. This data for sale encompasses:
- full names,
- passport details,
- dates of birth,
- phone numbers,
- email addresses,
- physical addresses,
- physical attributes.
The breach reportedly also includes highly sensitive information such as source code, user manuals, and confidential communications between ICE agents and contractors, including discussions on investigative techniques, the Five Eyes alliance, and details on the Ukraine-Russia conflict, among others.
The breach was allegedly facilitated by exploiting a critical 0-day vulnerability in GitHub, allowing the attacker to steal GitHub tokens. While technical specifics of the vulnerability were not disclosed, the implications of such an exploit are scary for a massive amount of organizations globally.
