The key facts

  • Names, job titles and work contacts of more than 40,000 DHS employees have been published — about one-fifth of the department's workforce
  • The names, job titles, and work contacts of more than 40,000 DHS employees were published — about a fifth of the agency's workforce
  • More than half of the records concern CBP border patrol employees, with another 10,000 from ICE and HSI
  • Okta says it has no evidence of compromise of its systems; DHS has not yet commented on the incident
  • Okta says it has no evidence of a compromise of its systems; DHS has not yet commented on the incident

What happened

Personal data of more than 40,000 employees of the U.S. Department of Homeland Security (DHS) has been published online. TechCrunch reports, which verified part of the leak for authenticity by matching the names of known department employees against an offline copy of the database. The leak includes names, job titles and work contacts — email addresses, mobile numbers and office locations — of border and immigration agents, cybersecurity specialists and senior officials at the department.

Data source and scale

A hacker using the alias Department of Peace claims to have obtained the data from the Okta single sign-on system, which DHS uses to give employees and contractors access to the department's central network. The system also stores IT and log records for accounts, including information about which internal systems and applications each employee can access. The hacker left a note with the data: “They own our information, so it's fair that we own theirs,” and did not respond to TechCrunch's request for comment.

Who was affected by the leak

More than half of the dataset — about 21,000 records — concerns employees of Customs and Border Protection (CBP) working at airports and other ports of entry. Another roughly 10,000 records relate to employees of Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) unit, and just under a thousand to the cyber defense agency CISA. The remaining records concern headquarters and other agencies, including Citizenship and Immigration Services and the Federal Protective Service. According to timestamps in the records, the data was extracted around mid-August. The number of records corresponds to roughly one-fifth of DHS's workforce, which numbers about 220,000 employees.

Second DHS incident in a year

This is already the second DHS leak in a year involving the same hacker: earlier, he claimed to have stolen thousands of the department's contracts with the private sector, including defense contractors and suppliers of surveillance systems. In addition, in recent months there have been thefts of personal data of thousands of FBI agents and millions of active and former military personnel from the Pentagon's personnel department. It is unknown whether the vulnerability that enabled the breach has been fixed and whether DHS is aware of the data theft; a department representative did not immediately respond to TechCrunch's request. Okta said it is “aware of this report” but has “no evidence of compromise of our data or systems.”

What else the leak reveals

Beyond personal data, the dataset reveals which tools department employees use: it contains information about membership in Active Directory groups that control access to internal and third-party services. About 4,500 users, including ICE agents, are in the access group for the online therapy service Headspace, which had a contract with ICE worth $82,500that ended in 2023; a company representative said Headspace has not provided services to DHS or ICE since then. Dozens of groups reference the company Penlink, whose technology, according to its claims, tracks the geolocation of hundreds of millions of mobile devices; a company representative did not respond to a request. Another group includes more than 200 CBP users connected to the Mobile Fortify facial recognition app, which both CBP and ICE use to establish identity and verify immigration status. There are also groups with access to ChatGPT and ones connected to investigations of the Chinese hacker groups Salt Typhoon and Volt Typhoon.

Possible consequences

Researchers and transparency advocates believe the leaked data could provide valuable leads for investigations: agents' email addresses make Freedom of Information Act (FOIA) requests easier. 'Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a request that goes unanswered and one that produces results,' said Ryan Shapiro, director of the nonprofit organization Property of the People. DDoSecrets co-founder Emma Best called the data 'a catalyst for investigations' for journalists, members of Congress, lawsuits, and FOIA requests. The data was passed to journalist and hacker maia arson crimew, who shared a copy with the nonprofit leak archive DDoSecrets.