DHS personnel data leak exposes more than 40,000 employee records
Personally identifiable information for more than 40,000 U.S. Department of Homeland Security employees has been published online following a claimed breach involving an Okta single sign-on system used across the department. The records include names, job titles, work email addresses, mobile phone numbers and office locations for staff at multiple DHS agencies.
The dataset includes about 21,000 records associated with U.S. Customs and Border Protection, roughly 10,000 linked to Immigration and Customs Enforcement and its Homeland Security Investigations unit, and just under 1,000 associated with the Cybersecurity and Infrastructure Security Agency. Additional records relate to DHS headquarters, U.S. Citizenship and Immigration Services and the Federal Protective Service.
Directory data also reveals access structure
The individual using the handle Department of Peace claimed to have obtained the material from a DHS Okta environment. In addition to contact information, the records contain IT and login details tied to employee accounts, including information indicating which systems and internal applications users were permitted to access.
Timestamps indicate that the directory records were exfiltrated around mid-August. The total is equivalent to about one-fifth of DHS's workforce of approximately 220,000 staff. TechCrunch reported that it verified part of the material by matching several known DHS employees against an offline copy of the database.
Okta said it was aware of the report and stated that it had no evidence that its data or systems had been compromised. It remains unclear whether the vulnerability that enabled the theft has been remediated or whether DHS was aware of the incident when contacted for comment.
Groups identify tools used across agencies
The leaked information includes Active Directory group memberships, which can show the tools, services and third-party offerings available to users. Many records are associated with Microsoft 365, Adobe Acrobat and Citrix groups, but the dataset also identifies more specialised services and investigative technology.
About 4,500 users, including ICE agents and deportation officers, were listed in a group named Headspace_users. Headspace said it has not provided services to DHS or ICE since 2023, after a federal ICE contract for mental-health software ended that year.
Other groups reference Penlink, including Penlink PLX, which Penlink describes as a platform for capturing and analysing intelligence from phone calls, text messages, web activity and social media. The material also includes a group of more than 200 CBP users associated with Mobile Fortify, a facial-recognition application used by CBP and ICE to identify people and verify information and immigration status.
Why the exposure raises operational risk
Employee directories and access-group information can make targeted phishing, impersonation and social-engineering campaigns more credible. Even where the records do not contain passwords, a detailed view of personnel, locations, roles and available systems can help an attacker select targets and tailor lures to a particular agency or workflow.
The data may also support public-records research. Ryan Shapiro of Property of the People said that email addresses and telephone numbers can help researchers make more specific Freedom of Information Act requests. DDoSecrets co-founder Emma Best said the material could support journalism, Congressional inquiries, legal challenges and community action.
For organisations using central identity platforms, the practical implication is to treat directory exports, entitlement data and group memberships as sensitive security assets: restrict access, monitor unusual extraction activity, review privileged groups and prepare employees for highly tailored phishing if exposure is suspected.