Records on more than 41,000 current and former Department of Homeland Security employees and contractors were published online Wednesday in a searchable format, Nextgov/FCW reported. DHS called it a "potential breach." The release puts the names, contact details and job roles of federal law-enforcement and cybersecurity staff in public view, which creates openings for targeted phishing, impersonation and harassment.
What Happened
A hacktivist group calling itself the Department of Peace gave the data to the transparency nonprofit Distributed Denial of Secrets (DDoSecrets), which published it with a search tool, according to Nextgov/FCW and CyberScoop. The records include names, phone numbers, email addresses, job titles and internal group memberships. They span Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), Homeland Security Investigations, the Cybersecurity and Infrastructure Security Agency (CISA) and other components. Some entries list roles in surveillance, forensics and undercover work.
About 21,000 records relate to CBP, about 10,000 to ICE and its investigations arm, and just under 1,000 to CISA, TechCrunch reported. That is roughly one-fifth of a workforce TechCrunch put at about 220,000. Timestamps suggest the data was taken around mid-August, TechCrunch said.
The group says it took the directory from an Okta single sign-on service, which lets employees log in once to reach many applications. DDoSecrets co-founder Emma Best repeated that claim to Reuters, which said it could not corroborate it. Okta said it was aware of the reports and had no evidence that its data or systems were compromised.
DHS said it was aware of a potential breach, was working to address it and would share more information when available. It has not said how the records were obtained.
What Outlets Verified
No outlet has confirmed the full dataset. Reuters, in a report carried by The Korea Times, matched details for six named employees against credit-bureau and breach records and reached three employees, who confirmed their phone numbers. Nextgov/FCW matched a work phone number its reporter had obtained before the leak. TechCrunch said it confirmed part of the data against known employees. CyberScoop found numerous current CISA employees in the data, along with former leaders who left years ago, so some records are out of date.
The group framed the release as retaliation for stepped-up immigration enforcement that DHS Secretary Markwayne Mullin announced in July. It also claimed a DHS hack in March involving contract records.
Why It Matters
A staff directory that maps who works on which programs, and which internal groups and tools they belong to, is a ready-made target list for social engineering. TechCrunch said group memberships reveal access to tools such as Microsoft 365 and Citrix, detail that makes fake messages more convincing.
The claimed access route matters too. Single sign-on concentrates access in one place. If the hackers' account holds, a single weakness at the identity layer exposed data on tens of thousands of users. That remains unproven, but it is a prompt for leaders to review who can query their own identity directories.
The leak follows other federal personnel exposures. The Primary Wire reported in September, citing TechCrunch, that ShinyHunters claimed theft of FBI agent and applicant data. It also reported, citing SecurityWeek, that a Defense Manpower Data Center breach exposed records on about 3 million people. Reuters called the DHS leak the third major government data leak in a month.
What to Watch
Watch for DHS or its inspector general to explain how the data was taken and whether the weakness has been closed; TechCrunch said that was unclear. Also watch for guidance to affected employees, reaction in Congress and any findings on the single sign-on claim.
