Personal information belonging to more than 40,000 U.S. Department of Homeland Security employees, including border and immigration agents, has been published online after a previously undisclosed breach of the department's systems this year. The data includes names, job titles, emails, cell phone numbers and office locations, and was claimed by a hacker using the handle Department of Peace.
A hacker using the handle Department of Peace claimed the data was obtained from an Okta single sign-on system used by Homeland Security to let employees and contractors log into its central network. The files also include IT and login records for each account, including which systems and internal apps the employee is permitted to access. In a note left with the data, the hacker wrote: "They have our information, so it's only fair that we have theirs."
More than half of the records, some 21,000, relate to employees of U.S. Customs and Border Protection (CBP), who work at airports and other ports of entry. Another 10,000 are associated with Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations unit, and just under 1,000 with the cybersecurity agency CISA. The remainder cover headquarters staff and agencies including U.S. Citizenship and Immigration Services and the Federal Protective Service.
TechCrunch, which reported the breach, said it verified part of the data as authentic by matching the names of known department employees against an offline copy of the database. The records appear to have been taken around mid-August, based on timestamps on each entry. The data was provided to journalist and hacker maia arson crimew, who shared it with DDoSecrets, a nonprofit collective that hosts leaked datasets in the public interest.
Okta said it was aware of the report. "Okta is secure, and we have no evidence our data or systems were compromised," a spokesperson said.
The breach is the latest in a run of attacks on U.S. government systems, following earlier thefts of thousands of FBI agents' personnel records and of personal information belonging to millions of serving and former military personnel from the Pentagon's human resources unit. It is also the second claimed breach of Homeland Security this year: the same hacker previously said they had taken thousands of contracts between the department and private-sector companies, including defense contractors and surveillance vendors. The disclosure comes ahead of the U.S. midterm elections, where the department's record has become a key issue for voters.
The leaked files also reveal third-party tools some staff can access. About 4,500 users, including ICE agents and deportation officers, are members of a group called Headspace_users, named for the online therapy provider, which said it has not provided services to the department or ICE since 2023. Dozens of groups reference Penlink, a company that says its technology can track the location data of hundreds of millions of mobile devices, and more than 200 CBP users are linked to Mobile Fortify, a facial recognition app used by CBP and ICE. Other groups relate to ChatGPT access, including for senior officials, and to investigations into the China-backed hacking groups known as Salt Typhoon and Volt Typhoon.
Researchers and transparency advocates said the data could provide leads for investigations into alleged abuses by the Trump administration, including identifying agents' email addresses for use in Freedom of Information Act requests. "Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results," said Ryan Shapiro, executive director of the transparency nonprofit Property of the People. DDoSecrets co-founder Emma Best said the data will be a "catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests."
Analysis
Why This Matters
- The exposed records identify federal border and immigration agents by name, job title and contact details, raising risks for individual employees as well as for the department.
- The data reveals which internal systems and third-party tools, including location tracking and facial recognition products, agency staff can access.
- The breach follows recent thefts of FBI personnel records and Pentagon human resources data, pointing to broader vulnerabilities in federal identity systems.
Background
The Department of Homeland Security is the U.S. federal agency responsible for border protection, immigration enforcement and cybersecurity, spanning agencies including Customs and Border Protection, Immigration and Customs Enforcement and the Cybersecurity and Infrastructure Security Agency. It employs around 220,000 people. Okta is a major provider of single sign-on and identity management services used by large organizations; the hacked system was the central entry point for employees and contractors logging into the department's network.
The disclosure is the second claimed breach of Homeland Security by the same hacker this year, following a reported theft of department contracts, and comes after separate attacks that exposed FBI personnel records and Pentagon human resources data.
Key Perspectives
Department of Peace (the hacker): claimed the data came from Homeland Security's Okta single sign-on system, writing in a note left with the files: "They have our information, so it's only fair that we have theirs."
Okta: said "Okta is secure, and we have no evidence our data or systems were compromised."
Headspace: said it has not provided any services to DHS or ICE since 2023.
Ryan Shapiro, Property of the People: said email addresses and phone numbers are indispensable tools for FOIA researchers, "often making the difference between a vague records request that gets stonewalled and one that gets results."
Emma Best, DDoSecrets: called the data a "catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests."
What to Watch
- Whether Homeland Security confirms the breach publicly and whether the underlying vulnerability has been fixed, which has not been established.
- Whether researchers and journalists convert the contact data into FOIA requests and investigations, as transparency advocates anticipate.
- Whether the same hacker releases further material, given the earlier claimed theft of department contracts this year.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- Partly supportedA hacker released data belonging to more than 40,000 Homeland Security employees.TechCrunch: “Personally identifiable information belonging to thousands of U.S. Department of Homeland Security employees has been published online after a hacker stole reams of data”
- SupportedThe files allegedly taken from DHS’s Okta system include contact details, access records and links to surveillance tools.TechCrunch: “The Okta system also contains IT and login records associated with the employees’ user account, including details about which systems and internal apps they are permitted to access.”
- SupportedPersonal information belonging to more than 40,000 DHS employees was published online after a previously undisclosed breach earlier this year.TechCrunch: “The breach includes names, job titles, and work contact information, such as email addresses, cell phone numbers, and office locations, of more than 40,000 people who work for the federal department”
- SupportedDepartment of Peace wrote, “They have our information, so it’s only fair that we have theirs.”TechCrunch: ““They have our information, so it’s only fair that we have theirs,” said Department of Peace in a note left with the data, which TechCrunch has seen.”
- SupportedThe dataset includes about 21,000 CBP records, another 10,000 associated with ICE and HSI, and just under 1,000 associated with CISA.TechCrunch: “More than half of the dataset — some 21,000 records — relate to employees with U.S. Customs and Border Protection (CBP)”
- SupportedThe records appear to have been taken around mid-August, based on entry timestamps.TechCrunch: “The thousands of employee directory records appear to have been exfiltrated around mid-August, according to the timestamps on each person’s record.”
- SupportedAn Okta spokesperson said, “Okta is secure, and we have no evidence our data or systems were compromised.”TechCrunch: ““Okta is secure, and we have no evidence our data or systems were compromised,” a spokesperson said.”
- SupportedAbout 4,500 users, including ICE agents and deportation officers, belong to a group called Headspace_users, and Headspace said it has not provided services to DHS or ICE since 2023.TechCrunch: “The data also shows that around 4,500 users, including ICE agents and deportation officers, are members of a group called “Headspace_users.””
- SupportedDozens of groups reference Penlink, which says its technology can track location data from hundreds of millions of mobile devices.TechCrunch: “Dozens of other user groups reference Penlink , a web surveillance company that makes technology it claims can track the location data of hundreds of millions of mobile devices.”
- SupportedMore than 200 CBP users are associated with Mobile Fortify, a facial recognition app used by CBP and ICE agents.TechCrunch: “One user group also includes more than 200 CBP users associated with Mobile Fortify, a facial recognition app used by both CBP and ICE agents”
- SupportedRyan Shapiro said, “Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results.”TechCrunch: ““Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results,” said Ryan Shapiro”
- SupportedEmma Best said the data will be a “catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests.”TechCrunch: “DDoSecrets co-founder and journalist Emma Best said that the exposed Homeland Security data will be a “catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests.””
