CISA/DOGE Software Engineer's Login Credentials Appeared in Multiple Leaks From Info-Stealing Malware in Recent Years (arstechnica.com) 90
"Login credentials belonging to an employee at both the Cybersecurity and Infrastructure Security Agency and the Department of Government Efficiency have appeared in multiple public leaks from info-stealer malware," reports Ars Technica, "a strong indication that devices belonging to him have been hacked in recent years."
As an employee of DOGE, [30-something Kyle] Schutt accessed FEMA's proprietary software for managing both disaster and non-disaster funding grants [to Dropsite News]. Under his role at CISA, he likely is privy to sensitive information regarding the security of civilian federal government networks and critical infrastructure throughout the U.S. According to journalist Micah Lee, user names and passwords for logging in to various accounts belonging to Schutt have been published at least four times since 2023 in logs from stealer malware... Besides pilfering login credentials, stealers can also log all keystrokes and capture or record screen output. The data is then sent to the attacker and, occasionally after that, can make its way into public credential dumps...
Lee went on to say that credentials belonging to a Gmail account known to belong to Schutt have appeared in 51 data breaches and five pastes tracked by breach notification service Have I Been Pwned. Among the breaches that supplied the credentials is one from 2013 that pilfered password data for 3 million Adobe account holders, one in a 2016 breach that stole credentials for 164 million LinkedIn users, a 2020 breach affecting 167 million users of Gravatar, and a breach last year of the conservative news site The Post Millennial.
The credentials may have been exposed when service providers were compromised, the article points out, but the "steady stream of published credentials" is "a clear indication that the credentials he has used over a decade or more have been publicly known at various points.
"And as Lee noted, the four dumps from stealer logs show that at least one of his devices was hacked at some point."
Thanks to Slashdot reader gkelley for sharing the news.
Lee went on to say that credentials belonging to a Gmail account known to belong to Schutt have appeared in 51 data breaches and five pastes tracked by breach notification service Have I Been Pwned. Among the breaches that supplied the credentials is one from 2013 that pilfered password data for 3 million Adobe account holders, one in a 2016 breach that stole credentials for 164 million LinkedIn users, a 2020 breach affecting 167 million users of Gravatar, and a breach last year of the conservative news site The Post Millennial.
The credentials may have been exposed when service providers were compromised, the article points out, but the "steady stream of published credentials" is "a clear indication that the credentials he has used over a decade or more have been publicly known at various points.
"And as Lee noted, the four dumps from stealer logs show that at least one of his devices was hacked at some point."
Thanks to Slashdot reader gkelley for sharing the news.
2fa / passkeys - mandate or suffer (Score:1)
all services
must be 2FA or passkeys
or suffer
users can not be blamed...
Re:2fa / passkeys - mandate or suffer (Score:4, Insightful)
users can not be blamed...
Good news! No one will be held accountable for the consequences of this.
Re: (Score:3)
users can not be blamed...
Good news! No one will be held accountable for the consequences of this.
That will certainly be the case as the Trump administration is allergic to responsibility and accountability (except when you have displeased dear leader).
Tech workers need to be held to a higher standard, which is why we get paid more. My standard day starts with getting a coffee, logging onto my non-privileged account with a password that regularly expires, connecting to VPN, using 2FA to access the secure password portal and generating my first password of the day to access my privileged account, whic
Re:2fa / passkeys - mandate or suffer (Score:5, Insightful)
Re: (Score:1, Troll)
There's something to be said about the assumption of carelessness without evidence by a poster on Slashdot. Namely get the fuck out of here and go back to Wired. There is a single incident that can be traced to one of his devices being hacked and no mention of how the device was hacked, whether from social engineering, a careless download, or a zero day that didn't require anything more than an internet connection.
Re: (Score:3, Interesting)
Are we really gonna pretend that what is supposed to be a security professional at the highest levels of access and accept using a set of compromised credentials for a decade? Hacked or not he isn't representing like the Agriculture department, he works for CISA supposedly.
Did he know he was hacked and took precautions? That's what I would expect from a professional and I know everyone on this website if it wasn't political but some other executive or person did this same thing we'd all the dunking and havi
Re: (Score:2)
I horde stolen creds. My shit own only comes up in breaches. Maybe if he didn't pirate video games?
Re: (Score:2)
There's no personal responsibility anymore. Kyle Schutt can go and fire people and no doubt destroy their family's lives with a keyboard and a login, but when he's careless in the execution of his own job, some slashdotters only blame 2FA or passkeys. It's sad what America has been reduced to. A lot of hot air about defending freedom and protecting their homes with guns, then meekly accepting Kyle's antics.
On that,
Dearest NRA,
Regarding your promises and ostensible raison d'etre, you seem to have forgotten to rise up against an oppressive government that has taken over your country.
Yours Sarcastically
Everyone who saw though your bullshit from the start.
Re: (Score:2)
It's sad what America has been reduced to. A lot of hot air about defending freedom and protecting their homes with guns, then meekly accepting Kyle's antics.
Americans don't get to choose what happens with Kyle. What do you propose the average American do? Go arrest him?
No, the fault lies exclusively with the leadership... and no matter how you spin it, you can not claim Americans voted for this exact scenario.
Re: (Score:2)
Re: (Score:2)
Users can be blamed for getting hit with cred stealing malware over and over.
SCale is the difference (Score:5, Insightful)
Not everyone has.
I know people who never had.
And myself - I had credentials leaked but like 5 times in 20 years...
Not 50+ in 5 ...
I would not approve security credentials for someone who seems to be quite reckless...
Re: (Score:1)
I don't know. Creating accounts everywhere to test login might just be part of the job. Or it's insider. One is more probable than the other.
Re: (Score:2)
Yeah and you use other email addressesor usernames so youre not getting cred stuffed.
Re: (Score:1, Insightful)
Not everyone has.
I know people who never had.
And myself - I had credentials leaked but like 5 times in 20 years...
Not 50+ in 5 ...
I would not approve security credentials for someone who seems to be quite reckless...
First off, this is a CISA employee. A software engineer no less. I would assume strongly and confidently that work-related credentials were forced (under Fed security NIST standards) to use two-factor/MFA. But you won’t find a confirmed fact that proves that in the shitty summary full of political innuendo.
The shitty summary tries to clarify that his “hacked” accounts were likely more personal (Gmail). Is YOUR employer keeping track of how many times their employees get their Gmail and
Re:SCale is the difference (Score:5, Informative)
First off, this is a CISA employee. A software engineer no less. I would assume strongly and confidently that work-related credentials were forced (under Fed security NIST standards) to use two-factor/MFA.
You would think so, but you would be wrong.
Apparently DOGE employees have been given administrative access without being required to follow Federal access standards, and have been plugging unapproved non-government devices directly in to the network (a huge violation of federal standards) in order to uplink to Starlink to bypass federal data-logging.
Re: (Score:1)
Re: (Score:2)
jesus christ if someone cant secure their gmail i wouldn't hire them for a security role. Bend over backward harder slut.
Doesn't compute (Score:2)
I see absolutely no logic in what you say. It's as if you're blaming the person for sites being hacked.
The number of leaks only depends on your online presence (and some luck). Do you expect people to not use their personal email? Even my work email, although it doesn't appear on any list, could have been leaked from the NVIDIA forums breach. Would that have been my fault?
Re:So has everyone else (Score:5, Insightful)
Because government agencies typically are the first to adopt new authentication technologies in order to ensure security of the data within. They were among to first to implement those little RSA keys to log in to critical databases, as well as heavy logging of secure databases. And they get lots of training to ensure the databases holding taxpayer data is kept secure.
So the fact that Elon Musk can come in with this 19 year old "rock star" who has such poor opsec that he reuses his credentials on sensitive government data shoudl be immediately appalling. Especially given how that data has been leaked. DOGE has basically infiltrated all the government databases, copied them all, and basically put them online.
You can bet anyone else working for DOGE will now be attempted to be hacked in order to get at those databases.
The way it's come in makes you wonder what security is like at SpaceX or Tesla, and maybe some of those same leaked credentials can be used to steal data from them as well. Or maybe it's just government data since who cares about the everyday American?
Re: (Score:1)
Or did you think he was 7 when his paid adobe creds were stolen?
Re:So has everyone else (Score:5, Insightful)
But not everyone's devices are hacked with credential stealers and who knows what else. The guy's op-sec is clearly shit, and now he is inside critical government systems. Given that even senior people in National Security can't seem to avoid using compromised chat apps on their devices, it seems quite likely that this guy is giving your enemies full access to everything he touches.
Re: (Score:2)
A user with good op-sec wouldn't get their device hacked in order for the strong password to be stolen in the first place.
Re: (Score:2)
Most security breaches are on the server side.
Microsoft, Cisco, Apple, they all had account details compromised, including passwords.
Re:So has everyone else (Score:5, Insightful)
If the people advising people about best practices don't follow them, then how can you blame regular users that don't or, given his work for DOGE, potentially even have failing to maintain password security be used as grounds for dismissal? That said, there's no guarantee that he's not using 2FA alongside these compromised passwords, in which case the risk would be significantly mitigated, but that just gets him off the hook for a bad actor being able to exploit his accounts for further mischief, not for the poor password hygiene.
Re: (Score:2)
To the best of my knowledge, none of my credentials have ever leaked. And I have tested against HIBP (offline) and Kali lists from time to time.
DOGEs true, treasonous agenda /s (Score:5, Insightful)
Re: (Score:2, Interesting)
https://www.npr.org/2025/04/15... [npr.org]
Re:DOGEs true, treasonous agenda /s (Score:4, Informative)
You were so eager to post your media rant, you skipped the whole discussion about how this was filed as an official whistleblower complaint. It's not something invented by "the media".
This part was important too:
DOGE has ignored federal law at every step. They've ignored common-sense safeguards. They have demanded root access to databases.
Among other things, they have cross-referenced IRS data and Immigration records. That is expressly prohibited by the law. It's also fucking stupid - undocumented people pay a shit-ton of taxes, as a way to try an stay under the radar. That'll stop now.
DOGE has broken into NLRB records, and now a number of labor organizers have reported getting harassed. Probably not a coincidence.
You can find links to this stuff if you want; it's not a secret.
But let's be honest - anybody still screaming 'TDS' at this point is simply not paying attention to what's really happening.
Re: (Score:1)
You were so eager to post your media rant, you skipped the whole discussion about how this was filed as an official whistleblower complaint. It's not something invented by "the media".
This part was important too:
DOGE has ignored federal law at every step. They've ignored common-sense safeguards. They have demanded root access to databases.
Among other things, they have cross-referenced IRS data and Immigration records. That is expressly prohibited by the law. It's also fucking stupid - undocumented people pay a shit-ton of taxes, as a way to try an stay under the radar. That'll stop now.
DOGE has broken into NLRB records, and now a number of labor organizers have reported getting harassed. Probably not a coincidence.
You can find links to this stuff if you want; it's not a secret.
But let's be honest - anybody still screaming 'TDS' at this point is simply not paying attention to what's really happening.
The People are paying attention alright. Again, I want to see the hardcore proof of records deletion and secret access being covered up. DOGE is a brand-new department officially recognized by the Government. The access required to do their one fucking job that has NEVER actually been done, is going to be incredible to define with boundaries. But I’d love for you to think about it and elaborate. You promised American voters an audit would occur. You promised DOGE. You have no more than three ye
Re: (Score:2, Interesting)
If letting DOGE run wild is such a good idea, why are they deleting access logs? Where the fuck is that radical transparency we were promised?
I expect DOGE to follow the law; They have destroyed entire agencies, in direct violation of the law. But at least the billionaires won't be bothered by those pesky agencies that were protecting consumers. And Elon will be able to fire anyone that shows up in the NLRB databases.
BTW, DOGE isn't saving any money;
https://www.cbsnews.com/video/... [cbsnews.com]
https://www.cbsnews.com/n [cbsnews.com]
Re:DOGEs true, treasonous agenda /s (Score:4, Interesting)
This administration has sent people to a concentration camp. They have sent masked police to detain people for writing op eds. They have threatened to send citizens to concentration camps.
The fuckers are even having a fucking conversation about suspending habeas corpus.
And for some unfathomable reason, people who once called themselves small-government conservatives are cheering this. It's just stunning to see people living the boiled-frog metaphor.
A lot those aforementioned fascism cheerleaders seem to think the panopticon and the cruelty will be limited to immigrants. In addition to that attitude's heartlessness, it's an amazingly stupid ignorance of history.
https://www.wired.com/story/do... [wired.com]
https://newrepublic.com/articl... [newrepublic.com]
https://www.theatlantic.com/te... [theatlantic.com]
Re: (Score:3, Insightful)
DOGE is a brand-new department officially recognized by the Government.
Actually it isn't. They had to rename an existing agency because creating a new one is a power explicitly given only to Congress. They couldn't even openly say that Musk is in charge of it because that would require congressional scrutiny on his appointment. In fact, when a judge asked members of DOGE who was running it in open court they couldn't provide an answer.
Re: (Score:2)
Go soak your head, you fucking dork.
Re: DOGEs true, treasonous agenda /s (Score:2)
How many other evidence-free conspiracy theories do you believe in? It was just as unhinged in the McCarthy era, perhaps you'd be more comfortable in the 1950s?
Re: (Score:2)
Being featured in leaks doesn't mean much (Score:2, Interesting)
Unless these credentials are actually active, it doesnâ(TM)t really mean anything. It is just one of the "perks" of working in Cybersecurity
Re: Being featured in leaks doesn't mean much (Score:1)
No, it's Russia. You see, the country with the weakest, smallest, drunkest, least advanced military in the world (yet somehow we need a worldwide military alliance so we can hug and cry together over the terrible menace), also has the most advanced mind control rays in the world.
Totally unlike the poor, beleaguered USA who is just invading countries halfway around the world out of the goodness of their hearts.
Re: (Score:2)
The USA has played defender since WW2 for the whole world. As such they played a major role in peace keeping operations around the world.
In exchange, the US Dollar is used as the world's reserve currency. Due to this informal agreement, the Fed can print as much debt as it wants and someone or the other, will pay the Fed for it. Essentially the Fed has a no-limit Amex, that the whole world has been happily payin
Plausible deniability (Score:2)
Mission accomplished
Why this is news. (Score:5, Interesting)
More than a few seem to not understand this story, so a summation of this follows.
Agree or disagree, this is what the story is all about.
Re: (Score:3)
The fact that his credentials have been found in four recent info dumps (rather than just one or two) is an indicator that his computer system has been compromised rather than the information being taken from a compromised business.
It does not. It could mean that he is InfoSec professional that has many accounts related to his job to monitor various hacker forums.
* Put it together and it means the inner workings of FEMA (and billions of dollars in funding) are all at risk.
It does not. You are asserting without proof that these credentials were reused across various context (sensitive vs. throwaway). Do you have any evidence of that?
Re:Why this is news. (Score:4, Insightful)
If you dig into the detail, the leaked credentials were stolen from hackers who obtained them from compromised devices. They are not website leaks of throwaway accounts, they are stolen from devices infected with malware.
Given that members of the current administration have already been seen in public using compromised apps, and given that he is likely to be a major target for rival spy agencies looking for ways into US government systems, it was always a concern that Musk employed unvetted and very questionable people, and then got them full access to key systems.
Re: (Score:1)
These are personal accounts unrelated to his work. There is no reason to assume that his work computer ever touched them. There
Re: (Score:1)
It could mean that he is InfoSec professional that has many accounts related to his job to monitor various hacker forums.
Yes, it could mean that.
You are asserting without proof that these credentials were reused across various context (sensitive vs. throwaway). Do you have any evidence of that?
Probably not.
Then again, had an analogue to DOGE been enrolled by a democratic president and a member of that DOGE ended up in the same situation as the one at hand, you and a horde of others would be effectively frothing at the mouth right about now.
Deny it if you wish, but you know that it is true.
Re: (Score:1)
I don't care about that. What I care about is that some dickhead is claiming that because his personal creds appeared in (only) four dumps, he must have compromised devices. My data has been in more than four, and without being hacked. LinkedIn was hacked, his LinkedIn creds are mentioned. A news site was hacked, and his personal login
Re: (Score:1)
And yet this guy is having his reputation smeared and will probably get fired just because some reporter wanted to find a DOGE employee that had some creds stolen.
Why this isn't news (Score:2)
This is speculation. Speculation isn't news. As you say, it's "an indicator" that he might have had a compromised system. On the other hand, it's far from being proof. Of course, people tend have the view of "guilty until proven innocent", but I don't think there's a good case of going that way, although I do think it's worth further investigation just to put people's minds at ease.
Re: Why this isn't news (Score:1)
The content of the speculation isn't news but the fact of the speculation is news. Often cited by other actors as justification for their political bullshit.
Worked out real well when they tried the exact same tactics with the pee tape dossier.
We're handing the most sensitive info (Score:2)
And we are giving all of it to them. Every last bit of government data is going to be in Elon musk's and his teenage boys' hands.
And it turns out they are completely incompetent morons who can't even keep basic passwords secure.
Re: (Score:2)
Agree or disagree, this is what the story is all about.
With all due respect I disagree only slightly, because the problem is much, much more extensive.
Citation:
https://www.youtube.com/watch?... [youtube.com]
More citations:
https://slashdot.org/submissio... [slashdot.org]
https://slashdot.org/submissio... [slashdot.org]
NLRB whistleblower interview (Score:3)
A whistleblower complaint filed by an IT staffer claims Elon Musk and his DOGE team gained access to sensitive data that could have led directly to a “significant cybersecurity breach.” Amna Nawaz discussed more with NLRB whistleblower Daniel Berulis and attorney Andrew Bakaj. Watch the fascinating interview of this technical person and whistleblower, with good technical details shared directly from him.
We're not talking about any single agency here, we're talking about many multiple agencies 30
Re: (Score:1)
That his personal creds appeared in four breaches means nothing. So have mine, and it wasn't because my computer was infected, it was because I have had a lot of accounts on a lot of sites, often for limited purposes. If I didn't care about the sit
Boy genius turns out to be ... (Score:2)
Re: (Score:1)
Probably no real problem (Score:3)
As the article says, anyone with a large online presence is likely to have their account details stolen. The stealer logs are the issue, but they often pad themselves with previously stolen credentials. So it's not clear to me if any of this person's devices has actually been hacked. The stealer logs could just be using data from the other breaches.
Someone with access to the stealer logs could determine this, but up front for a person with such a large presence in the breaches data, I'm inclined to believe that's where the stealer logs got it, rather than an actual infected device of this person.
Victim blaming, Opsec, and old email addresses (Score:1)
By itself this doesn't mean he was directly compromised. We need to be really careful about inferring things from presence on these stealer lists and breach tracking sites. This is the second time in the last couple weeks that I have seen a "stealer" list being used to discredit someone.
You can easily end up on these without having ever had a directly compromised device of your own. If you have an email password combination that was breached in any of the many public breaches listed out there (see https [haveibeenpwned.com]
So? (Score:2)
"Only the best people" (Score:5, Insightful)
Having worked for the feds as a developer I can tell you emphatically, I am never allowed to administer anything, period. There's no user account giving me permissions to change ANYTHING on any system, period. The most I can do is push code to the GIT server. Okay sure, I can try to be influential by setting up at prototype of something, somewhere else, but that's about it.
Yet young Big Balls has God Level rights against the most vociferous resistance of various agencies heads, (following the illegal dismissal of the attorneys general), before those agency protestors have been removed, one way or the other. How and why did that happen?
We know who allowed it, no secret there.
In a word: corruption.
There's a price to be paid to keep the criminal in chief out of jail and serving his people. Fellow criminals can rejoice now -- the list of fellow criminals is long.
The entire list is extremely disgusting although I have a favorite candidate for most evil scumbag: "libertarian" Ross Ulbricht [wikipedia.org] who couldn't be happier with his connection to DJ Trump.
Criminals seem to respect and look out for each other. The people are fucked. We're all gonna pay for this.
Re: (Score:2)
I believe you meant "inspectors general" rather than "attorneys general". But "corruption" and "criminal" are always apposite w/r/t current administration.
Re: (Score:2)
Yes, thank you for your observant correction. I did mean inspectors general.
Re: (Score:2)
DOGE isn't needed, and never has been needed. Get the fuck off this website.
Re: (Score:1)
Every single taxpaying American knows how inefficient Government is. Every American armed with wisdom and common sense knows how corrupt the status quo is.
Unfortunately, it is not a requirement for a statement that "everyone knows" to be true. Back in reality, the government is significantly more efficient than the private sector. And nothing DOGE does will save any significant amount of money directly and everything it does will result in the transfer of more wealth to the owners of large companies in the long term because their actual goal is the destruction of regulations and to push for privatization (which always makes things more expensive because you h
Re: (Score:1)
Every single taxpaying American knows how inefficient Government is. Every American armed with wisdom and common sense knows how corrupt the status quo is.
Unfortunately, it is not a requirement for a statement that "everyone knows" to be true. Back in reality, the government is significantly more efficient than the private sector.
Really? Remove any and all political bias and look at the factual cost of NASA vs. SpaceX. I’ll wait while you remember just how ignorant that statement really is. If Government was so efficient, they wouldn’t epitomize inefficiency in triplicate so damn hard.
And nothing DOGE does will save any significant amount of money directly and everything it does will result in the transfer of more wealth to the owners of large companies in the long term because their actual goal is the destruction of regulations and to push for privatization (which always makes things more expensive because you have to pay for profit in addition to the cost to provide the service). DOGE is blatant corruption in plain sight.
DOGE in concept is desperately needed. DOGE is nothing more than an audit on the status quo. Tell me again how the status quo was working so well under Bidenomics. You think DOGE is a financial scam? I’d love to know how anothe
Re: (Score:2)
It'll be interesting hearing the Democrats version of DOGE.
It was called competence. During the Clinton administration, they reduced the federal workforce by almost 400,000.
Unlike DOGE, they didn't have to violate the law, or arbitrarily fire people, or let children die, or export everyone's data into some sort of master database, or just create chaos and then lie about the results.
Afterwards, right-wing media spent decades telling people over and over that everything that happened during the Clinton years
Re: (Score:1)
pfffttt....
someone's been watching too much mainstream media...
Yes, but (Score:2)
Re: (Score:1)
We should all be able to see that the claims here (Score:1)
My LinkedIn creds were leaked just like millions of others'. Does that mean any of my work creds were leaked? Hell no! Does it mean I have a compromised device? Everyone here knows it doesn't.
The claims are not just absurd and unsupported by any evidence pr
MFA and risk based challenges... (Score:1)