Perceptics breach exposes CBP traveller images and plate-reader documents

In June 2019, U.S. Customs and Border Protection subcontractor Perceptics was breached in what CBP called a malicious cyberattack. Images of travellers’ faces and license plates, contracting documents and other data were made publicly available on the internet. About 184,000 traveller images from CBP’s facial-recognition pilot were compromised, and at least 19 were posted to the dark web. The attackers also obtained contractual documents, program-management documents, emails, system configurations, schematics and implementation documentation related to CBP license-plate-reader programs. Perceptics had downloaded sensitive CBP data from an unencrypted device and transferred it to the company’s network, violating DHS security requirements. Perceptics was suspended from federal contracts, subcontracts, grants and loans in June 2019; the suspension was lifted in September 2019. A September 2020 DHS Inspector General report found CBP did not adequately safeguard the data, though no federal networks were compromised.