DHS data breach exposes 41,000 federal employees in identity-layer attack
More than 41,000 employees of the U.S. Department of Homeland Security (DHS) had personal information exposed after a hacker claimed access to an Okta single sign-on (SSO) system used by the agency. The incident marks a troubling pattern of attacks targeting the corporate identity infrastructure and comes amid the DHS's intensive deportation operations, potentially putting agents and staff at significant risk.
What was leaked
The data, published on Distributed Denial of Secrets — a transparency platform run by activist collective Motley Fox — contains names, job titles, email addresses, cell phone numbers, and office locations of employees across multiple agencies under the DHS umbrella. The breakdown includes:
- 21,000 records of U.S. Customs and Border Protection (CBP) employees, the largest single unit; - 10,000 records of Immigration and Customs Enforcement (ICE) and Homeland Security Investigations (HSI) staff; - Nearly 1,000 records from the Cybersecurity and Infrastructure Security Agency (CISA); - Additional records from U.S. Citizenship and Immigration Services and the Federal Protective Service.
Beyond contact information, the dataset contains details about which internal systems and applications each employee is permitted to access — including user groups tied to Microsoft 365, Adobe Acrobat, Citrix, and web surveillance tools.
More concerning: approximately 4,500 users, including ICE agents and deportation officers, were members of a group called "Headspace_users," linked to an online therapy provider that previously held a federal contract with ICE. The dataset also reveals employees associated with ChatGPT access, including senior DHS officials, as well as groups linked to investigations of China-backed hacking groups.
Who is behind it
The hacker, operating under the handle "Department of Peace," claimed to have obtained the data through an Okta single sign-on service used by DHS. The group had previously claimed responsibility for a March 2026 DHS breach, when it released documents related to contracts with external vendors.
In a note left alongside the data, Department of Peace wrote: "They have our information, so it's only fair that we have theirs," and stated it hoped the data "can be used to limit further harm by the DHS and supports all efforts in that direction."
The Motley Fox nonprofit, which hosts the leaked data on DDoSecrets, provided the dataset to journalist and hacker Maia Arsen Crimew, who then shared a copy with the DDoSecrets platform itself.
Okta and DHS responses
Okta, one of the world's largest identity providers, issued a statement to TechCrunch and Reuters denying any compromise:
> "Okta is secure, and we have no evidence our data or systems were compromised."
DHS, for its part, issued a statement saying it was "aware of a potential breach and working to address the situation swiftly and effectively," assuring it would protect its employees.
However, it remains unclear whether the vulnerability that enabled the leak has been patched or if DHS has concrete confirmation that the data was actually exfiltrated. A department spokesperson did not immediately respond to requests for comment.
Context and significance
This is the second incident involving DHS this year — in March, the same hacker claimed to have stolen thousands of contracts between the department and the private sector. The leak also fits into a broader wave of attacks on federal agencies: in September, a group called ShinyHunters claimed to have stolen records from thousands of FBI employees, including sensitive medical details.
The timing is not trivial. Journalists had already verified portions of the data: Reuters confirmed personal information about six DHS employees by cross-referencing credit bureau records and breach data carried on the dark web intelligence platform District 4 Labs. NBC News and the Washington Post were able to confirm phone numbers and other details directly with current employees.
The revelation came weeks after DHS Secretary Markwayne Mullin said ICE would be "turning up the heat on the streets" — making the leak not just a privacy violation, but potentially a physical safety issue for agents working in sensitive deportation and surveillance operations.
DHS employees had already begun wearing masks at work last year to hide their identities — a clear symptom of how current political tensions directly affect operational security. The dataset, whose exfiltration appears to have occurred around mid-August, equals about one-fifth of DHS's total workforce of approximately 220,000 employees.
Sources: TechCrunch, CNBC, NBC News, Reuters/Politico, The Guardian
✓ Independent sources cross-checked and verified before publishing
