DHS Breach Exposes Data and System Access for 40,000 Employees
A hacker published data on 40,000-plus DHS workers, exposing CBP, ICE and CISA contacts and access to surveillance tools after an Okta-linked breach.
Summary
By October 28, 2026, hacker Department of Peace had published names, titles, work emails, cell numbers and office locations for more than 40,000 Department of Homeland Security workers. Timestamps indicate extraction around mid-August. The leak equals about one-fifth of DHS’s 220,000 staff: roughly 21,000 Customs and Border Protection employees, 10,000 Immigration and Customs Enforcement and Homeland Security Investigations personnel, just under 1,000 CISA staff, plus headquarters, U.S. Citizenship and Immigration Services and Federal Protective Service workers. Department of Peace claimed access through DHS’s Okta single sign-on, whose records map each user’s permitted systems and apps. A sample matched known staff. DHS has not said whether it knew of the theft or fixed the weakness; Okta found no compromise of its data or systems.
Active Directory memberships show most listed workers had Microsoft 365 access, alongside Adobe Acrobat and Citrix. About 4,500, including ICE deportation officers, remained in “Headspace_users”; Headspace’s $82,500 ICE mental health contract ended in 2023, and it says service stopped then. Penlink groups ranged from a handful to more than 2,000 HSI users; Penlink PLX analyzes real-time calls, texts, web activity and social media. Another group tied more than 200 CBP users to Mobile Fortify facial recognition. Other groups covered senior officials’ ChatGPT access and Salt Typhoon and Volt Typhoon investigations.
The hacker framed publication as reciprocity, and maia arson crimew passed the data to nonprofit DDoSecrets. The breach follows the same hacker’s theft of DHS private-sector contracts, plus separate FBI personnel and Pentagon military HR breaches. Ryan Shapiro of Property of the People says the contacts can sharpen Freedom of Information Act requests; DDoSecrets co-founder Emma Best expects journalism, congressional inquiries, legal challenges and community action. The exposure arrives before the U.S. midterms amid scrutiny of DHS deportations, detentions and killings of U.S. citizens.
Positives
- Okta found no evidence that its data or systems were compromised in the incident.
- Headspace says it has provided no DHS or ICE services since its $82,500 contract ended in 2023.
- Ryan Shapiro says the exposed contacts could make Freedom of Information Act requests more precise and effective.
- Emma Best expects the dataset to support journalism, congressional inquiries, legal challenges and community action.
Risks & concerns
- More than 40,000 DHS workers had names, titles, work contacts and office locations published online.
- Roughly 21,000 CBP employees, 10,000 ICE and HSI personnel, and nearly 1,000 CISA staff appear in the dataset.
- Active Directory records exposed access relationships involving Penlink PLX, Mobile Fortify, ChatGPT and internal investigations.
- DHS has not disclosed whether it knew about the theft or whether the weakness used around mid-August has been fixed.
- The incident follows separate thefts involving DHS contracts, FBI personnel records and Pentagon military HR data.