Contact Details of Thousands of Homeland Security Workers Posted Online
Names, job titles, and work contact details for more than 40,000 employees of the U.S. Department of Homeland Security have been published online. The breach had not been made public earlier in 2026, according to TechCrunch, which reported the leak on October 28, 2026.
The records cover many kinds of staff. About 21,000 belong to U.S. Customs and Border Protection (CBP). Another 10,000 belong to Immigration and Customs Enforcement (ICE), including its Homeland Security Investigations (HSI) unit. Just under 1,000 work at the Cybersecurity and Infrastructure Security Agency (CISA). Several thousand more are at department headquarters and other parts of DHS, including U.S. Citizenship and Immigration Services and the Federal Protective Service. The total is about one-fifth of a department with roughly 220,000 workers.
The entries include email addresses, cell phone numbers, and office locations.
A hacker using the name "Department of Peace" said the data came from Okta, the login system DHS uses so that employees and contractors can sign in to its central network. The hacker left a note with the data: "They have our information, so it's only fair that we have theirs."
TechCrunch confirmed that part of the data was genuine. It matched the names of several known DHS employees against an offline copy of the database. Timestamps on individual records suggest the data was copied around mid-August 2026, about two months before it was published.
The dataset was then passed to maia arson crimew, who shared a copy with DDoSecrets. DDoSecrets is a nonprofit group that hosts leaked datasets in the public interest. Once a copy reached that public archive, anyone who looks for it can find the records.
The broader context here is what a login system like this holds. It keeps a directory of user accounts, and its records can show which applications each person is allowed to open. In effect, it is a map of who can get into what. The people on that map are the ones whose phone numbers are now in circulation. For a department that includes border agents, criminal investigators, and cyber defenders, names, job titles, and phone numbers can help someone pose as a colleague. Phishing, a scam where a person pretends to be someone you trust to get you to hand over a password or click a bad link, works much better when it uses a real job title.
In my view, the lesson applies well beyond one agency. Login systems have become the main gatekeeper for access to large organizations. Keeping them in one place brings real benefits, such as consistent rules and faster removal of people who leave. It also puts more weight on fewer systems. Zero-trust designs try to limit the damage from a stolen login by checking every request, rather than assuming anyone already inside the network can be trusted. The open question is how much of that protection still works when an attacker already has the full list of permissions.
There is also a more hopeful side. Contact details can be changed, access rules can be tightened, and the same identity tools that carry the risk can help defenders check, cut off, and reissue access across an organization. What is not yet clear is how quickly those steps will be taken after a disclosure of this size.
