Hacker publishes data on 40,000 DHS employees stolen via Okta login system

Hacker publishes records on more than 40,000 Homeland Security employees

A hacker has published personally identifiable information belonging to more than 40,000 U.S. Department of Homeland Security employees following a previously undisclosed breach at the department earlier this year, TechCrunch reports. The exposed records cover border and immigration agents, cybersecurity staff and senior officials, and include names, job titles, work email addresses, cell phone numbers and office locations.

The hacker, who uses the handle Department of Peace, claimed the data was taken from an Okta single sign-on system that Homeland Security uses to let employees and contractors across its agencies log into the department's central network. According to TechCrunch, the compromised system also held IT and login records tied to each account, including details of which internal systems and applications users were authorized to access. In a note accompanying the data, the hacker framed the leak as reciprocity, arguing that because the department collects information on the public, the public deserved the same in return. The stolen data was passed to journalist maia arson crimew, who shared a copy with DDoSecrets, a nonprofit collective that hosts leaked datasets.

Okta told TechCrunch it was aware of the report but said it had no evidence that its own data or systems were compromised and maintained that its platform is secure.

The scale of the leak

More than half of the dataset, roughly 21,000 records, relates to employees of U.S. Customs and Border Protection, who work at airports and other ports of entry. Another 10,000 records concern staff at Immigration and Customs Enforcement and its Homeland Security Investigations unit, and just under 1,000 belong to employees of the Cybersecurity and Infrastructure Security Agency. Thousands of additional records cover the department's headquarters and other agencies, including U.S. Citizenship and Immigration Services and the Federal Protective Service.

TechCrunch says it verified a portion of the data as authentic by matching known Homeland Security employees against an offline copy of the database, and timestamps on individual records suggest the exfiltration happened around mid-August. In total, the leak is equivalent to about one-fifth of the department's 220,000-person workforce. It remains unclear whether the vulnerability behind the breach has been fixed or whether Homeland Security is even aware of the theft; a department spokesperson did not respond to TechCrunch's request for comment, and the hacker did not reply to questions about how the intrusion was carried out.

Directory data maps the department's software

Beyond personal contact details, the dataset offers a partial map of the technology Homeland Security depends on, because it includes employees' memberships in Active Directory user groups that control access to internal tools and third-party services.

Most of the employees in the dataset belong to a group granting access to Microsoft 365, along with groups for everyday desktop software such as Adobe Acrobat and Citrix. Around 4,500 users, including ICE agents and deportation officers, appear in a group named Headspace_users; TechCrunch notes that online therapy provider Headspace previously held an $82,500 ICE contract, which ended in 2023, and the company says it has provided no services to DHS or ICE since.

Dozens of user groups reference Penlink, a web surveillance vendor whose technology it claims can track the location data of hundreds of millions of mobile devices. These groups range from a handful of users in local offices to more than 2,000 users across ICE's Homeland Security Investigations unit, and one references Penlink PLX, which the company markets for capturing and analyzing real-time intelligence drawn from calls, messages, web browsing and social media. Penlink did not respond to a request for comment. Another group ties more than 200 CBP employees to Mobile Fortify, a facial recognition app used by CBP and ICE agents to identify people and verify immigration status, while further groups show ChatGPT access for some senior officials and work connected to investigations of the China-backed hacking groups Salt Typhoon and Volt Typhoon.

Why it matters

According to TechCrunch, this is the second Homeland Security breach this year claimed by the same hacker, after the earlier theft of thousands of contracts between the department and private firms including defense and surveillance vendors. It also follows recent breaches involving FBI personnel records and the personal information of millions of serving and former military personnel from the Pentagon's human resources unit.

The episode underlines how much sensitive metadata concentrates in identity systems: a single sign-on platform can hold not just logins but a directory of who works where and which surveillance tools they can use. For the agents and officials involved, publishing cell numbers and office locations is a direct personal security risk. Transparency groups see investigative value in the leak. Ryan Shapiro of Property of the People said employee email addresses and phone numbers often determine whether a Freedom of Information Act request succeeds or stalls, and DDoSecrets co-founder Emma Best predicted the data would catalyze journalism, congressional inquiries, legal challenges and records requests. Until Homeland Security responds publicly, how the breach happened and whether the underlying flaw is fixed remain open questions.