U.S. Department of Homeland Security

Summary

A hacker known as Department of Peace stole personnel data from an Okta single sign-on system used by the U.S. Department of Homeland Security, exposing names, job titles, work email addresses, cell phone numbers, and office locations for more than 40,000 employees, including border and immigration agents, cybersecurity staff, and senior officials. The dataset also revealed internal Active Directory group memberships granting access to Microsoft 365, Adobe Acrobat, Citrix, Headspace therapy services, Penlink web surveillance tools, Mobile Fortify facial recognition, and ChatGPT, with the stolen records later shared with journalist maia arson crimew and the DDoSecrets collective. The department acknowledged awareness of a potential breach, while Okta denied any compromise of its own systems.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A hacker using the handle Department of Peace stole personnel data belonging to thousands of U.S. Department of Homeland Security employees and published it online in a previously undisclosed breach that occurred earlier in 2026. The stolen information includes names, job titles, and work contact details such as email addresses, cell phone numbers, and office locations for more than 40,000 people who work for the federal department, including border and immigration agents, cybersecurity staffers, and senior department officials. The hacker claimed to have obtained the data from an Okta single sign-on system used by Homeland Security to allow employees and contractors across its various agencies to log in to its central network, a system that also contains IT and log-in records and details about which systems and internal apps employees are permitted to access. TechCrunch verified a portion of the data as authentic by matching the names of several known Homeland Security employees against an offline copy of the database. Timestamps on each person's record indicate that the thousands of employee directory records were exfiltrated around mid-August. The number of leaked records is equivalent to about one-fifth of Homeland Security's workforce, which totals around 220,000 staff. The hacker left a note with the data stating, "They have our information, so it's only fair that we have theirs," and did not respond to TechCrunch's email requesting comment or questions about how the breach was carried out. It remains unclear whether the vulnerability that allowed the breach has been fixed or if Homeland Security was aware of the data theft before publication.

More than half of the dataset, some 21,000 records, relates to employees with U.S. Customs and Border Protection, while another 10,000 records concern employees of Immigration and Customs Enforcement and its Homeland Security Investigations unit, and just under 1,000 records involve employees at the Cybersecurity and Infrastructure Security Agency. Thousands of additional records relate to staff at the department's headquarters and other agencies, including U.S. Citizenship and Immigration Services and the Federal Protective Service. The dataset also reveals membership in user groups within the department's Active Directory, showing that most employees had access to Microsoft 365, Adobe Acrobat, Citrix, and other typical desktop software. Around 4,500 users, including ICE agents and deportation officers, were members of a group called Headspace_users, referencing an $82,500 federal contract with ICE that ended in 2023 for mental health software required for ERO employees; a Headspace spokesperson said the company has not provided services to DHS or ICE since 2023. Dozens of other user groups reference Penlink, a web surveillance company with a longstanding ICE contract, with groups ranging from a handful of users in local offices to more than 2,000 users across ICE's HSI unit nationally, including one group specifically referencing Penlink PLX for capturing and analyzing real-time intelligence from phone calls, texts, web activity, and social media. A Penlink spokesperson did not respond to a request for comment. One user group includes more than 200 CBP users associated with Mobile Fortify, a facial-recognition app used by CBP and ICE agents to identify people and verify information and immigration status. Other groups include employees associated with ChatGPT access, including senior DHS officials, and groups tied to investigations into the China-backed hacking groups Salt Typhoon and Volt Typhoon. The stolen data was provided to journalist and hacker maia arson crimew, who then shared a copy with DDoSecrets, a nonprofit collective that hosts leaked datasets. A Homeland Security spokesperson told TechCrunch after publication that DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively, adding that the department takes all security threats against its employees and officers seriously and will update the public when more information is available. Okta said it was aware of the report and stated that Okta is secure and that it has no evidence its data or systems were compromised. The incident marks the second breach involving Homeland Security this year after the same hacker claimed to have taken thousands of contracts between the department and the private sector, and it follows earlier hacks involving the theft of FBI agents' personnel records and personal information of millions of serving and former military service personnel from the Pentagon's human resources unit.

Sources

Sources available to members: 1 source.