Personally identifiable information belonging to thousands of employees of the U.S. Department of Homeland Security has been made publicly available following a data breach that occurred earlier this year, which had not been previously disclosed. This breach encompasses names, job titles, and work-related contact details, including email addresses, cell phone numbers, and office locations, affecting over 40,000 individuals employed by the federal department, including border and immigration agents, cybersecurity personnel, and senior officials.
A hacker operating under the alias Department of Peace claimed responsibility for the breach, asserting that they accessed the data through an Okta single sign-on system utilized by Homeland Security. This system enables employees and contractors across various agencies to log into the department’s central network. Additionally, the Okta system contains IT and login records linked to the employees’ user accounts, detailing which systems and internal applications they are authorized to access.
More than half of the compromised dataset—approximately 21,000 records—pertains to employees of U.S. Customs and Border Protection (CBP), who are stationed at airports and other points of entry. The data also includes records for around 10,000 employees from Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) unit, as well as just under 1,000 employees from the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Additional records involve staff from the department’s headquarters and other agencies, including U.S. Citizenship and Immigration Services and the Federal Protective Service.
“They have our information, so it’s only fair that we have theirs,” stated Department of Peace in a note accompanying the data, which was reviewed by hinews. The hacker did not respond to inquiries from hinews regarding the breach or its execution. This incident marks the latest in a series of data breaches affecting the U.S. government in recent months, following earlier incidents involving the theft of personnel records from thousands of FBI agents and the personal information of millions of current and former military personnel from the Pentagon’s human resources division.
This incident also represents the second breach involving Homeland Security this year, as the same hacker previously claimed to have acquired thousands of contracts between the department and private sector entities, including defense contractors and surveillance vendors. The most recent collection of compromised data, which appears to be authentic, provides a rare—albeit incomplete—insight into the scale and operations of Homeland Security, an agency whose practices regarding deportations, arbitrary detentions, and the deaths of U.S. citizens have become significant concerns for voters ahead of the upcoming midterm elections.
The stolen data from Homeland Security was shared with journalist and hacker maia arson crimew, who subsequently provided a copy to DDoSecrets, a nonprofit collective dedicated to hosting leaked datasets for the public good. hinews verified a portion of the data as authentic by cross-referencing the names of several known Homeland Security employees with an offline version of the database. The timestamps on each record indicate that the thousands of employee directory records were likely exfiltrated around mid-August. The volume of leaked records represents roughly one-fifth of Homeland Security’s total workforce, which is approximately 220,000 staff members. It remains unclear whether the vulnerability that facilitated the breach has been addressed or if Homeland Security is aware of the data theft.
A spokesperson for Homeland Security did not provide an immediate response to hinews’ request for comments regarding the breach. When contacted, Okta acknowledged awareness of the report, stating, “Okta is secure, and we have no evidence our data or systems were compromised,” according to a company spokesperson.
While the leaked data contains identifiable information about agents and officers, it also sheds light on the surveillance technologies and cybersecurity tools that Homeland Security employees may access. Critics have called for investigations into technology companies that provide services or funding to ICE. The leaked dataset includes information regarding employees’ memberships in user groups within the department’s Active Directory, a system that regulates access to internal tools, services, and third-party applications used for work.
The majority of Homeland Security employees featured in the dataset belong to a user group with access to Microsoft 365, the cloud service utilized by the agency for emails and files, as well as groups for accessing Adobe Acrobat, Citrix, and other standard desktop software. The data also reveals that approximately 4,500 users, including ICE agents and deportation officers, are part of a group labeled “Headspace_users.” Online therapy provider Headspace previously held an $82,500 federal contract with ICE, which concluded in 2023, to supply “mental health software required for ERO employees,” referring to ICE’s deportation unit. A spokesperson for Headspace stated that the company has not provided any services to DHS or ICE since 2023.
Numerous other user groups reference Penlink, a web surveillance firm that claims to offer technology capable of tracking the location data of hundreds of millions of mobile devices. Penlink has maintained a contract with ICE for several years. The size of the user groups varies, ranging from a few users in local Homeland Security offices nationwide to over 2,000 users within ICE’s HSI unit. One specific group mentions Penlink PLX, which the company asserts is utilized to capture and analyze “real-time intelligence” from phone calls, texts, web activity, and social media. A spokesperson for Penlink did not respond to a request for comment.
Another user group comprises more than 200 CBP users linked to Mobile Fortify, a facial-recognition application employed by both CBP and ICE agents to identify individuals and verify their information and immigration status. Additionally, the user groups include several employees associated with access to ChatGPT, including senior DHS officials, as well as other groups involved in investigations into China-backed hacking groups known as Salt Typhoon and Volt Typhoon.
Researchers and advocates for public information assert that the exposed data could yield valuable leads for investigations into alleged abuses by the Trump administration, such as identifying email addresses of agents that could be utilized in public records requests under the Freedom of Information Act. “Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results,” remarked Ryan Shapiro, the executive director of the transparency nonprofit Property of the People. “Given the Trump administration’s contempt for even basic transparency, the need for such tools is urgent,” Shapiro added.
DDoSecrets co-founder and journalist Emma Best stated that the exposed data from Homeland Security will serve as a “catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action, and Freedom of Information Act requests.”
