The U.S. Department of Homeland Security (DHS) is facing one of the largest data breaches in its history after hackers published personal information on over 41,000 employees and contractors of the agency. The data, which includes names, job titles, phone numbers, email addresses, and office locations, was obtained through a vulnerability in an Okta single sign-on (SSO) system that the DHS uses to manage authentication across its thousands of workforce members spread among various subordinate agencies.
The hacktivist group calling itself "Department of Peace" claimed responsibility for the operation and made the dataset public early Wednesday, October 28, via a dedicated leak website. The information was passed to Swiss hacker and journalist maia arson crimew, who in turn shared the material with the nonprofit collective Distributed Denial of Secrets (DDoSecrets), which hosted the database in an open format for journalistic and public transparency purposes. According to the Department of Peace, the database was extracted directly from the Okta SSO service that the DHS uses to allow employees and contractors to log into its central network.
The numbers behind the breach are staggering. Nearly 21,000 records belong to employees of U.S. Customs and Border Protection (CBP), the branch that operates at border crossings and airports. Another 10,000 records are tied to agents of U.S. Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) unit. Just under a thousand records relate to personnel at the Cybersecurity and Infrastructure Security Agency (CISA), the department's cyberdefense arm. The remainder covers staff at DHS headquarters and other agencies, including U.S. Citizenship and Immigration Services and the Federal Protective Service.
Beyond personal information, the dataset includes details about which systems and internal applications each employee is permitted to access — granularity of information that, in the context of a domestic security agency, can reveal not only the identities of agents but the access structure of entire units. Several user groups in the database reference covert projects, including Penlink, a geolocation surveillance company that claims to track location data from hundreds of millions of mobile devices, and Mobile Fortify, a facial recognition application used jointly by CBP and ICE to identify individuals and verify immigration status.
The motivation behind the attack is political. In a note left alongside the data, the Department of Peace justified the operation as a response to the operational escalation promises made by DHS Secretary Markwayne Mullin. "On July 17, Markwayne Mullin said he was 'turning up the heat.' This is what happens to ICE when you do that," a spokesperson for the group said, clearly referencing the deportation operations that have been ramping up under the current administration. The hacker did not respond to emails from TechCrunch requesting comment on how the breach was carried out.
Okta, meanwhile, issued a forceful defense. In a statement to Reuters and other outlets, the company said: "Okta is secure, and we have no evidence our data or systems were compromised." The statement, however, contrasts with the acknowledgment that the company is aware of the report — and with the fact that the breach, if confirmed as authentic, suggests an exploitation of the SSO service that was not mitigated in time. DHS did not immediately respond to requests for comment from TechCrunch about the incident.
Independent verification of the data by Reuters was substantial. The agency was able to match personal information about six DHS employees listed in the leak against credit bureau records and breach data carried by the District 4 Labs intelligence platform. In other cases, Reuters called three DHS employees directly and was able to confirm their phone numbers and other details. One of the employees said it was the first they had heard of the breach.
The incident does not occur in a vacuum. This is the second attack on the DHS this year. In March, the same group claimed responsibility for a leak that exposed thousands of contracts between the department and private contractors, including defense firms and surveillance vendors. Earlier, in September, hackers released personal records of thousands of FBI agents, and earlier in the year, security firm GitGuardian discovered a public GitHub repository containing credentials for privileged AWS GovCloud accounts and internal CISA systems — data dating back to November 2025.
Historically, the DHS has suffered other major breaches. In 2014, an attack that may have exposed data of 390,000 current and former employees was discovered. In January 2018, the department notified approximately 250,000 people about a breach at the Office of the Inspector General. The repetition of similar incidents over a decade raises structural questions about the department's ability to protect sensitive data of its own workforce — especially when the target is an agency whose work involves covert operations, surveillance, and law enforcement in a politically polarized climate.
What makes this case particularly sensitive is the political moment in which it occurs: the U.S. midterm legislative elections are just weeks away. Several of the employees listed in the database hold leadership positions in deportation and surveillance operations that have become central issues in the election campaigns. For agents in the field and for intelligence personnel, the exposure of contact and location information can have direct implications for personal safety.
The broader lesson here goes beyond any single vulnerability. A federal department with hundreds of thousands of employees and dozens of subordinate agencies is running on identity infrastructure that, if compromised, turns the agency's own workforce into the primary victims. Okta may be secure, but security only matters if the entry point is identified and sealed before the next breach happens — and if the department takes steps to ensure that its next-door neighbor, the FBI, doesn't suffer the same fate once again.
Sources: The Verge, TechCrunch, CyberScoop
✓ Independent sources cross-checked and verified before publishing
