Personal and operational details for more than 41,000 Department of Homeland Security employees and contractors have been published online, exposing personnel across agencies including Immigration and Customs Enforcement, Customs and Border Protection and the Cybersecurity and Infrastructure Security Agency. The disclosure, first reported by CyberScoop, includes names, work email addresses, phone numbers, office locations, job titles and information about assignments.
The nonprofit Distributed Denial of Secrets said it received the dataset from a hacktivist group calling itself the Department of Peace and published it in a searchable archive. The group claims it obtained the records through an Okta single sign-on service used by DHS employees and contractors. That account has not been independently established, and the database was taken offline by Thursday morning, limiting public access but not necessarily containing copies already downloaded or redistributed.
DHS said it is aware of a potential breach and is working to determine the scope, assess threats and protect affected personnel. Okta, meanwhile, said it had found no evidence that its own systems or data were compromised, telling SecurityWeek: “Okta is secure, and we have no evidence our data or systems were compromised.” The distinction leaves open several possibilities, including a compromise of DHS-controlled data or an account, configuration or integration connected to the identity service rather than Okta’s core infrastructure.
The exposure is particularly serious because the records reportedly identify personnel involved in sensitive enforcement, investigative and cybersecurity work. Even where the information is not classified, combining employee identities, direct contact details, job functions and organizational relationships can enable targeted phishing, impersonation, harassment, doxxing and intelligence gathering. It may also help attackers map access paths into government systems. The dataset reportedly spans current and former personnel and contains historical group references dating back years, making immediate credential and personnel-security reviews important.
The Department of Peace described the release as retaliation for DHS plans to intensify Immigration and Customs Enforcement operations. That claimed motive does not by itself establish the group’s identity, the intrusion method or the full authenticity of the records. DHS personnel and contractors should treat unexpected messages, password-reset prompts and requests for operational information as potential social-engineering attempts, while the department investigates affected accounts, preserves logs, revokes suspicious sessions and coordinates notification and protective measures. Organizations exchanging information with DHS should also review trust relationships and monitor for phishing campaigns that use the leaked employment data.
