INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Homeland Security Workers Data Stolen and Published Online

| 2026-10-30 11:33 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A group of hackers calling themselves the Department of Peace stole and published the personal details of more than 41,000 people working for the US Department of Homeland Security (DHS) in mid-August. The data includes names, work email addresses, phone numbers, office addresses, job titles, and membership in internal DHS groups, affecting nearly 6,600 Immigration and Customs Enforcement employees and over 21,000 Customs and Border Protection employees. The hackers published the data online as part of a tactic to "replace anonymity with accountability," according to DDoSecrets co-founder Emma Best. The attack was reportedly launched in response to a July statement by DHS Secretary Markwayne Mullin, who promised to increase traffic stops.
Technical Mitigations AI-generated
• Update Okta's SSO service to patch the vulnerability that allowed hackers to access user credentials. • Implement two-factor authentication for all DHS employees using Okta, and ensure that users are aware of phishing attempts. • Monitor Active Directory groups for suspicious activity and restrict access to sensitive tools and services based on job titles and clearance levels.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters
Target & Sectors
NORTH_AMERICA NORTH_AMERICA DACH DACH
Incident Timeline
‎July 17
Threat actors launched a cyberattack in response to DHS Secretary Markwayne Mullin's July 17 statement promising increased traffic stops.
‎2026/10/30
Hackers, claiming to be the Department of Peace, stole and published personal details of over 41,000 US Department of Homeland Security workers.
organisation the Department of Peace
A group of hackers calling themselves the Department of Peace says it stole and published the personal details of more than 41,000 people working for the US Department of Homeland Security (DHS).
The Department of Peace said that it got to the information via a single sign-on (SSO) service provided by identity company Okta.
organisation the US Department of Homeland Security
A group of hackers calling themselves the Department of Peace says it stole and published the personal details of more than 41,000 people working for the US Department of Homeland Security (DHS).
organisation SSO
The Department of Peace said that it got to the information via a single sign-on (SSO) service provided by identity company Okta.
organisation Homeland Security
Hackers steal and publish data on 41,000 Homeland Security workers.
victims 41,000 Security workers
Hackers steal and publish data on 41,000 Homeland Security workers.
In this article Hackers published work details and internal group memberships for more than 41,000 DHS workers.
organisation Hackers
In this article Hackers published work details and internal group memberships for more than 41,000 DHS workers.
organisation DHS
In this article Hackers published work details and internal group memberships for more than 41,000 DHS workers.
organisation BlueLeaks
The latter also published the BlueLeaks data dump that listed law enforcement officers’ details in 2020.
organisation Immigration and Customs Enforcement
The employees impacted include almost 6,600 Immigration and Customs Enforcement (ICE) employees.
victims 6,600 employees
The employees impacted include almost 6,600 Immigration and Customs Enforcement (ICE) employees.
organisation Customs and Border Protection
The dataset also carried details of over 21,000 Customs and Border Protection (CBP) employees, along with information on people who work at the Cybersecurity and Infrastructure Security Agency (CISA).
organisation CBP
The dataset also carried details of over 21,000 Customs and Border Protection (CBP) employees, along with information on people who work at the Cybersecurity and Infrastructure Security Agency (CISA).
victims 21,000 employees
The dataset also carried details of over 21,000 Customs and Border Protection (CBP) employees, along with information on people who work at the Cybersecurity and Infrastructure Security Agency (CISA).
threat_actor ShinyHunters
The data dump revealed less information than the ShinyHunters’ FBI data heist in September, which reportedly contained Social Security numbers, emergency contacts, medical records and home addresses.
organisation Social Security
The data dump revealed less information than the ShinyHunters’ FBI data heist in September, which reportedly contained Social Security numbers, emergency contacts, medical records and home addresses.
organisation Reuters
Reuters matched six DHS employees’ data to credit bureau records and breach data from a dark web intelligence platform.
organisation OSINT
Online activists regularly use open-source intelligence (OSINT) to “doxx” people from very few clues, meaning that even a leak of basic identity information can put someone in danger.
organisation Microsoft
The data in this case also included membership of groups within Active Directory, a Microsoft tool that contains identity information about computer users.
organisation Mobile Fortify
The files listed over 200 CBP users in a group that could access the facial recognition tool Mobile Fortify.
victims 200 CBP users
The files listed over 200 CBP users in a group that could access the facial recognition tool Mobile Fortify.
organisation Guardian
According to the Guardian , job titles in the data dump show which agents were assigned to sensitive jobs such as special operations, surveillance, and undercover work.
organisation MFA
Verify them through a contact method you already trust, and never share passwords or MFA codes.
organisation Identity Theft Protection
Check out the Malwarebytes Identity Theft Protection service.
Tactical Metrics
Metrics
victims
41,000
Security Workers
Hackers steal and publish data on 41,000 Homeland Security workers.
In this article Hackers published work details and internal group memberships for more than 41,000 DHS workers.
Metrics
victims
6,600
Employees
The employees impacted include almost 6,600 Immigration and Customs Enforcement (ICE) employees.
Metrics
victims
21,000
Employees
The dataset also carried details of over 21,000 Customs and Border Protection (CBP) employees, along with information on people who work at the Cybersecurity and Infrastructure Security Agency (CISA).
Metrics
victims
200
Cbp Users
The files listed over 200 CBP users in a group that could access the facial recognition tool Mobile Fortify.
Intelligence Sources
Malware Bytes 2026-10-30