Hacker Publishes Personnel Data on More Than 40,000 DHS Employees
Personally identifiable information belonging to thousands of U.S. Department of Homeland Security employees has been published online, following a breach that had not been publicly disclosed earlier in 2026. The records include names, job titles, and work contact details, among them email addresses, cell phone numbers, and office locations, for more than 40,000 DHS workers, according to TechCrunch, which reported the leak on October 28, 2026.
The dataset is broad. Roughly 21,000 records relate to employees of U.S. Customs and Border Protection (CBP). Another 10,000 belong to Immigration and Customs Enforcement (ICE), including its Homeland Security Investigations (HSI) unit. Just under 1,000 are staff at the Cybersecurity and Infrastructure Security Agency (CISA), and several thousand more cover DHS headquarters and other components, including U.S. Citizenship and Immigration Services and the Federal Protective Service. The records span border and immigration agents, cybersecurity staff, and senior department officials. The total is about one-fifth of a department workforce of around 220,000.
A hacker using the handle "Department of Peace" claimed to have obtained the data from the Okta single sign-on system that Homeland Security uses to let employees and contractors log into its central network. The hacker left a note with the data: "They have our information, so it's only fair that we have theirs."
TechCrunch said it verified a portion of the data as authentic by matching the names of several known DHS employees against an offline copy of the database. According to timestamps on individual records, the directory data appears to have been exfiltrated around mid-August 2026. The publication date is therefore about two months after the apparent extraction.
The dataset was passed to maia arson crimew, who shared a copy with DDoSecrets, a nonprofit collective that hosts leaked datasets in the public interest. That chain of distribution is how a copy of the material moved from the original intruder into a public repository, and it is the reason the records are now reachable by anyone who seeks them out.
The broader context here is the nature of the system that was reportedly accessed. An identity provider in a single sign-on arrangement does more than store credentials. The IT and login records it holds describe user accounts and, as the reporting notes, which systems and internal applications each user is permitted to reach. A directory of that kind is a map of who has access to what, and the people on it are the ones whose contact details now sit in public circulation. For a federal agency whose workforce includes border enforcement, criminal investigations, and cyber defense staff, the exposure of names, roles, and reachable phone numbers creates a targeting and social engineering surface that extends well beyond the directory itself. Phishing and impersonation attempts built on accurate job titles and internal naming conventions are considerably more convincing than generic ones.
In my view, the lesson for practitioners is not confined to a single agency. Identity has become the control plane for enterprise access, and a compromise of that layer can expose both the attributes of workers and the topology of their permissions in one step. Organizations that centralize authentication gain real operational benefits, including consistent policy and faster offboarding, but they also concentrate risk in fewer, more valuable systems. Zero-trust architectures are designed to limit what a stolen identity can reach, and the question this episode raises is how much of that limitation holds when the attacker already has the directory of entitlements.
There is also a more hopeful reading. Directory data of this kind can be rotated, contact paths can be changed, and access policies can be tightened. Each of those steps is well understood, and the same identity tooling that carries the risk is also how defenders can verify, revoke, and reissue access at scale. What remains open is how quickly those controls are applied in response to a disclosure of this size.
