Leaked Files Reveal ICE Liaisons to U.S. Military Commands With Access to Surveillance Tech
Leaked Department of Homeland Security files indicate that U.S. Immigration and Customs Enforcement maintains liaison positions within several major U.S. military commands, including Special Operations Command, Africa Command, and Southern Command. These liaisons reportedly possess access to advanced surveillance tools such as PenLink, Falcon, and RavenGo, which allow for the tracking of mobile devices and the aggregation of commercial and government data. A hacker group known as the Department of Peace published the personnel data on the Distributed Denial of Secrets platform, prompting DHS to acknowledge a potential breach and demand the removal of the searchable database. The leaked records identify specific roles, such as a Combatant Command Program Manager and a Senior Liaison, while also linking some staff to the Liberty Crossing facility associated with the Office of the Director of National Intelligence. Additionally, the files detail a contractor role at the National Targeting Center under U.S. Central Command, highlighting a broader integration between immigration enforcement and military targeting infrastructure.
Polymarket suspended trading on its international platform for approximately one hour on Thursday following a security incident that compromised a third-party service provider. The prediction market operator stated that it paused operations out of an abundance of caution after identifying and rectifying the issue affecting its international site, Polymarket.com. Trading resumed in the afternoon, with the company confirming that it would fully reimburse any traders who suffered losses. Polymarket indicated that the attack appeared to originate from the United Kingdom and that the matter had been referred to British law enforcement authorities. The disruption lasted until approximately 3 p.m. Eastern Time, after which the platform came back online. While the company did not initially confirm specific financial losses, it issued a statement on the social media platform X asserting that it would make right any errors and fully compensate affected users. Reports indicate that the intrusion was facilitated through software provided by DebugBear, a UK-based firm specializing in website performance monitoring and web analytics. A person familiar with the details, who spoke anonymously to discuss the evolving security situation, stated that hackers accessed user funds via this third-party tool. Unverified reports emerged on Polymarket’s Discord channel claiming that user wallets had been drained. Although the company did not validate these specific claims, crypto news outlet The Block reported that approximately $2.65 million in cryptocurrency had been siphoned from user wallets, citing data from blockchain analysis group Arkham. A Polymarket representative declined to comment on the specific amount or the precise technical nature of the attack. The company emphasized that its U.S.-based platform did not appear to be affected by the breach. DebugBear acknowledged the incident on its own channels, posting around 2 p.m. Eastern Time that it was impacted by an ongoing security incident. The company’s website was unavailable during the afternoon of the event. DebugBear advised its clients to remove the embed code associated with its products from their websites. The firm did not immediately respond to requests for comment regarding the specifics of the compromise. Third-party vendor compromises have become a prevalent method for malicious actors to gain access to major digital platforms. This incident represents a significant breach given the successful exfiltration of funds from user accounts. Polymarket operates a high-volume trading environment, processing approximately $200 million in daily trading activity. The platform recently underwent a valuation increase to $21 billion in September, following a $1 billion investment round led by Donald Trump Jr. The security incident occurred amidst heightened scrutiny of prediction market platforms. Polymarket and its rival, Kalshi, are currently engaged in legal battles with U.S. states and the federal administration regarding regulatory jurisdiction over prediction market betting. Additionally, both platforms are actively investigating potential insider trading activities. Earlier in the day, Polymarket announced it was examining reports of suspicious bets placed during Israel’s elections. According to Shana Bautista, the company’s head of global intelligence and investigations, the firm is also reviewing dozens of bets related to upcoming U.S. midterm elections. Kalshi similarly reported that it was investigating suspicious wagers concerning the selection of a presidential press secretary. The timing of the Polymarket breach coincides with other notable security incidents affecting digital infrastructure and government entities. Separately, the fan fiction platform Archive of Our Own, operated by the nonprofit Organization for Transformative Works, went offline for what was intended to be routine maintenance but subsequently faced a prolonged outage. The organization detected evidence of a security incident and stated it could not rule out the theft of its user database, which contains usernames, email addresses, IP addresses, and hashed passwords. The site remained offline for an estimated period of two to four weeks while investigators determined the scope of the breach. Simultaneously, a hacker group identifying as the Department of Peace released a massive dataset containing personal information for more than 40,000 U.S. Department of Homeland Security employees. The leak included names, job titles, work emails, cell phone numbers, and office locations for staff across various agencies, including Immigration and Customs Enforcement and Customs and Border Protection. The hacker group claimed the data was extracted from an Okta single sign-on system used by DHS employees and contractors, with timestamps suggesting the extraction occurred around mid-August. Okta disputed the claim, stating there was no evidence its systems were compromised. The DHS responded to the personnel data leak by stating it was aware of a potential breach and was actively working to address the situation. The department emphasized that it takes all security threats against its employees seriously. The release of this data followed other recent breaches in the federal sector, including the exposure of personnel records for thousands of FBI agents and the leakage of sensitive information for millions of current and former military personnel from the Pentagon’s human resources unit. These concurrent incidents highlight widespread vulnerabilities in both private sector platforms and government infrastructure.
Go to the primary sources (8)
The official sources this coverage is built on. Read them directly to bypass framing.
A hacker using the alias 'Department of Peace' has released personal data for over 40,000 U.S. Department of Homeland Security employees, including names, contact information, and workplace locations for ICE agents, CBP officers, and cybersecurity staff. TechCrunch reported that the breach likely occurred in mid-August via an Okta single sign-on system, though Okta disputes being the source of the leak. The exposed records represent approximately one-fifth of the DHS workforce, with the majority belonging to Customs and Border Protection and Immigration and Customs Enforcement units. This incident marks the second major data breach involving DHS this year, following a previous theft of contractor agreements, and coincides with broader federal data compromises affecting the FBI and Department of Defense. A DHS spokesperson stated they are actively addressing the threat to protect their employees, while the hacker justified the release by claiming reciprocity since the government holds similar data on citizens.
Bias read (Center): The article presents a straightforward account of a cybercrime event, focusing on technical details of the breach, the specific departments affected, and official responses. While the subject involves sensitive government agencies like ICE and CBP, the tone remains factual and neutral, citing both a
Why factuality (85): Accurately reflects the primary source regarding the breach size, specific agency breakdowns, and the hacker's stated motive. However, it adds the phrase 'exposing... to potential harassment and violence,' which is an interpretive inference rather than a direct factual claim from the source text.
Why objectivity (70): Uses somewhat alarmist phrasing ('potential harassment and violence') in the opening sentence, which leans toward sensationalism compared to the neutral reporting in the source material.
Fox News (US)IndependentConservativeFactual 75Objective 60
The U.S. Department of Homeland Security (DHS) is investigating a significant data breach that allegedly exposed personal information, including names, titles, locations, and contact details, for approximately 40,000 employees and contractors. The affected individuals include roughly 10,000 personnel from Immigration and Customs Enforcement (ICE) and over 20,000 from U.S. Customs and Border Protection (CBP). An anti-fascist hacking group known as the 'Department of Peace' claimed responsibility for the theft, stating that the release was intended to hold DHS accountable for its actions. The data was published on the website Distributed Denial of Secrets, where a search tool allows the public to access the records. DHS officials confirmed they are aware of the incident and are taking steps to protect their staff, while noting that the leak includes sensitive information such as the identities of undercover agents.
Bias read (Conservative): The article frames the data breach primarily through the lens of national security risks and the safety of law enforcement officers, using terms like 'catastrophic' and highlighting the exposure of undercover agents. It emphasizes the hostile intent of the hacker group, describing them as 'anti-fasc
Why factuality (75): Correctly identifies the core facts of the breach and the number of affected employees. However, it attributes the term 'catastrophic' to unnamed sources, which is not supported by the primary source text, and mentions 'undercover ICE agents' which is a specific detail not explicitly detailed in the
Why objectivity (60): Includes unrelated headlines about political attacks on sanctuary cities and police protections, which introduces a partisan political frame and distracts from the objective reporting of the data breach itself.
Leaked Department of Homeland Security files indicate that U.S. Immigration and Customs Enforcement maintains liaison positions within several major U.S. military commands, including Special Operations Command, Africa Command, and Southern Command. These liaisons reportedly possess access to advanced surveillance tools such as PenLink, Falcon, and RavenGo, which allow for the tracking of mobile devices and the aggregation of commercial and government data. A hacker group known as the Department of Peace published the personnel data on the Distributed Denial of Secrets platform, prompting DHS to acknowledge a potential breach and demand the removal of the searchable database. The leaked records identify specific roles, such as a Combatant Command Program Manager and a Senior Liaison, while also linking some staff to the Liberty Crossing facility associated with the Office of the Director of National Intelligence. Additionally, the files detail a contractor role at the National Targeting Center under U.S. Central Command, highlighting a broader integration between immigration enforcement and military targeting infrastructure.
Bias read (Progressive): The article frames the revelation through a critical lens regarding civil liberties and state power, emphasizing the 'massive' nature of the leak and the intrusive capabilities of the surveillance technologies. By highlighting the connection to intelligence agencies and the use of tools like PenLink
Why factuality (60): Introduces highly specific claims about military liaisons (SOCOM, AFRICOM) and specific surveillance tools (Penlink, Falcon) that are not present in the provided primary source document. While these details might exist in the full dataset, they cannot be verified against the provided ground truth, m
Why objectivity (50): Frames the story entirely through the lens of national security overreach and surveillance capabilities, ignoring the broader context of the general personnel data breach mentioned in the source. This creates a narrow, critical perspective on the agency.
Prediction market platform Polymarket temporarily suspended trading on its international site for approximately one hour on Thursday following a security breach at a third-party vendor. Reports identify the compromised entity as DebugBear, a UK-based website performance monitoring service, which confirmed it was experiencing an active security incident and instructed clients to remove specific tracking codes from their sites. Polymarket stated it acted out of an abundance of caution and has committed to fully reimbursing any affected users while referring the matter to UK law enforcement authorities. The exact scope of user data exposure or financial impact remains unclear, though the company assured customers that those affected would be made whole.
Bias read (Center): The article reports on a corporate cybersecurity incident and operational disruption within the technology sector. There is no significant political controversy, partisan framing, or policy debate involved in the narrative, making it effectively apolitical.
Why factuality (0): Completely irrelevant to the primary source document. The article discusses a security incident at Polymarket, whereas the source describes a data breach at the Department of Homeland Security.
Why objectivity (0): Not applicable as the content does not match the subject matter of the evaluation set.
The fan-fiction platform Archive of Our Own (AO3) announced it would remain offline for an estimated two to four weeks following a detected security incident. Initially attributed to routine maintenance, the prolonged outage prompted the parent organization, the nonprofit Organization for Transformative Works (OTW), to release a formal statement confirming the breach. While OTW stated that there is no current evidence indicating the user database was stolen, they acknowledged the possibility cannot be ruled out, noting that the database contains usernames, emails, IP addresses, and hashed passwords. As a precautionary measure, users were advised to change passwords on other platforms if credentials were reused. Although recent critical vulnerabilities in the PHP programming language sparked speculation about the cause, the article clarifies that AO3 operates on the Ruby on Rails framework, making a connection to those specific flaws unlikely.
Bias read (Center): The article covers a cybersecurity incident affecting a technology platform. This is an apolitical subject matter focused on IT infrastructure, data privacy, and corporate communication rather than government policy, partisan politics, or ideological debates. The tone is factual and informative, and
Why factuality (0): Completely irrelevant to the primary source document. The article discusses a security incident at the fan-fiction site Archive of Our Own (AO3), whereas the source describes a data breach at the Department of Homeland Security.
Why objectivity (0): Not applicable as the content does not match the subject matter of the evaluation set.
Prediction market platform Polymarket suspended trading on its international site for approximately one hour on Thursday following a security breach attributed to a compromised third-party vendor, DebugBear. While the company stated that any affected users would be fully reimbursed, independent reports indicated that roughly $2.65 million in cryptocurrency was stolen from user wallets during the incident. Polymarket noted that the attack originated from the United Kingdom and has been referred to British law enforcement, while its domestic U.S. platform remained unaffected. The breach highlights ongoing security vulnerabilities associated with third-party integrations within the crypto ecosystem. Additionally, the article notes that Polymarket is currently investigating suspicious trading activities related to Israeli elections and upcoming U.S. midterm results.
Bias read (Center): The article primarily covers a cybersecurity incident and corporate response, which are apolitical topics. Although the piece mentions the regulatory dispute between states and the federal government regarding prediction markets, this serves as background context rather than the main focus. The tone
Why factuality (0): Completely irrelevant to the primary source document. The article discusses a security incident at Polymarket, whereas the source describes a data breach at the Department of Homeland Security.
Why objectivity (0): Not applicable as the content does not match the subject matter of the evaluation set.
The Washington TimesParty-alignedCenterFactual: no official source document/info detectedObjective 0
Polymarket has temporarily suspended trading operations on its international platform due to a security breach. The company stated that the incident involved a compromise of a third-party service provider rather than a direct attack on its core infrastructure. This pause was implemented on Thursday to mitigate risks associated with the vulnerability. No further details regarding the specific nature of the exploit or potential data exposure were provided in the brief report.
Bias read (Center): The subject matter concerns a corporate cybersecurity incident affecting a private prediction market platform. While financial platforms operate within regulatory frameworks, this specific event is primarily a technical and operational issue rather than a contested political debate. The article uses
Why factuality: no official source document/info detected
Why objectivity (0): Not applicable as the content does not match the subject matter of the evaluation set.
How each side covered it
The same event, grouped by the political lean of the outlets covering it.
progressive
center
conservative
★
How each side covered it
Support independent, bias-aware news and unlock the social pulse, community voting, and every other Supporter feature.
United States
