Personal Data of Thousands of DHS Employees Posted Online After Undisclosed Breach
Personally identifiable information belonging to thousands of U.S. Department of Homeland Security employees has been published online, following a breach that had not been publicly disclosed earlier in 2026. The records include names, job titles, and work contact details, including email addresses, cell phone numbers, and office locations, for more than 40,000 DHS workers, according to TechCrunch, which reported the leak on October 28, 2026.
The dataset is broad. Roughly 21,000 records relate to employees of U.S. Customs and Border Protection (CBP). Another 10,000 belong to Immigration and Customs Enforcement (ICE), including its Homeland Security Investigations (HSI) unit. Just under 1,000 are staff at the Cybersecurity and Infrastructure Security Agency (CISA), and several thousand more cover DHS headquarters and other components, including U.S. Citizenship and Immigration Services and the Federal Protective Service. The records span border and immigration agents, cybersecurity staff, and senior department officials. The total is about one-fifth of a department workforce of around 220,000.
A hacker using the handle "Department of Peace" claimed to have obtained the data from Okta, the single sign-on (SSO) system that DHS uses so employees and contractors can log into its central network. SSO lets a user authenticate once and then reach many applications. The hacker left a note with the data: "They have our information, so it's only fair that we have theirs."
TechCrunch said it verified a portion of the data as authentic by matching the names of several known DHS employees against an offline copy of the database. According to timestamps on individual records, the directory data appears to have been exfiltrated around mid-August 2026. The publication date is therefore about two months after the apparent extraction.
The dataset was passed to maia arson crimew, who shared a copy with DDoSecrets, a nonprofit collective that hosts leaked datasets in the public interest. That chain of distribution moved the material from the original intruder into a public repository, which is why anyone who seeks it out can now reach the records.
The broader context here is the system that was reportedly accessed. An identity provider in a single sign-on arrangement does more than store passwords. Its records describe user accounts and, as the reporting notes, which systems and internal applications each user may reach. A directory of that kind is a map of who has access to what, and the people on it are the ones whose contact details now circulate publicly. For an agency whose workforce includes border enforcement, criminal investigators, and cyber defense staff, names, roles, and phone numbers create a targeting surface well beyond the directory itself. Phishing and impersonation messages built on accurate job titles and internal naming conventions are considerably more convincing than generic ones.
In my view, the lesson is not confined to one agency. Identity has become the control point for enterprise access, and a compromise of that layer can expose both worker attributes and permission structures in one step. Centralized authentication brings real benefits, including consistent policy and faster offboarding, but it also concentrates risk in fewer, more valuable systems. Zero-trust designs aim to limit what a stolen identity can reach. The open question is how much of that limit holds when an attacker already has the directory of entitlements.
There is also a more hopeful reading. Directory data can be rotated, contact paths changed, and access policies tightened. Those steps are well understood, and the same identity tooling that carries the risk is how defenders verify, revoke, and reissue access at scale. What remains open is how quickly those controls are applied after a disclosure of this size.
