Data on more than 40,000 Homeland Security staff posted online after breach

Personal data on more than 40,000 employees of the U.S. Department of Homeland Security has been published online after a breach the department had not previously disclosed.¹

What was taken. The records include names, job titles, work email addresses, cell phone numbers and office locations. They cover border and immigration agents, cybersecurity staff and senior officials. About 21,000 records relate to Customs and Border Protection, about 10,000 to Immigration and Customs Enforcement and its investigations unit, and just under 1,000 to the cybersecurity agency CISA.¹

How it happened, as claimed. A hacker using the handle Department of Peace says the data came from an Okta single sign-on system, which is one login that opens many internal systems. The hacker did not answer TechCrunch’s questions about how the breach was carried out. Okta says it has no evidence its own data or systems were compromised.¹

What is confirmed. TechCrunch matched the names of several known employees against an offline copy of the database and found them authentic. Timestamps suggest the directory records were taken around mid-August. The leaked records equal roughly one-fifth of the department’s workforce of about 220,000.¹

The data also lists group memberships that control access to internal tools. About 4,500 users appear in a group named “Headspace_users.” Headspace says it has provided no services to DHS or ICE since 2023, so the group name alone shows nothing about a current relationship. Other groups reference the surveillance software Penlink and the facial recognition app Mobile Fortify.¹

What you should do. The people at risk are the listed employees, not the general public, and there is nothing for ordinary readers to change. Affected staff should expect their work emails and phone numbers to be misused for phishing or unwanted contact.

Department of Peace says the leak is retaliation, and the data went to DDoSecrets, a nonprofit that hosts leaked datasets. Researchers quoted by TechCrunch say the contact details could help with public records requests.¹

Our read: The confirmed part is narrow: real names and contact details, taken in August and now public. The hacker’s method and the department’s awareness remain unconfirmed, and the group listings show who had access to which systems, not how those systems were used. DHS has made no statement and has committed to no disclosure. Whether it addresses the breach is the next fact to watch.

This account rests on a single outlet’s reporting.

Footnotes

1. TechCrunch, “Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents”. Retrieved October 28, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶