INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Homeland Security Employees Data Leaked by Hacker

| 2026-10-30 06:26 CRITICAL HIGH DATA BREACH
JSON
Executive Summary
AI-generated
A hacker leaked personal data on more than 40,000 U.S. Department of Homeland Security (DHS) employees in a breach that occurred earlier this year and was only recently disclosed. The breach targeted border and immigration agents, cybersecurity staff, and senior department officials at the DHS, including those working for Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), and the Cybersecurity and Infrastructure Security Agency (CISA). The hacker used an Okta single sign-on system to steal data from the agency's central network, which also stored IT and login records. The leaked data includes names, job titles, work contact information, such as email addresses and office locations, of over 40,000 employees.
Technical Mitigations AI-generated
• Patch Okta single sign-on system to address potential vulnerabilities. • Monitor for signs of malicious activity related to the "Department of Peace" hacker, such as unusual login attempts or data exfiltration. • Implement additional security controls around sensitive employee information, including multi-factor authentication and role-based access control.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope governmentgovernment
Incident Timeline
‎2026/10/30
A hacker leaked personal data on more than 40,000 U.S. Department of Homeland Security employees after stealing it from an Okta single sign-on system.
organisation U.S. Department of Homeland Security
Personal details of thousands of U.S. Department of Homeland Security (DHS) employees are now online after a hacker stole reams of data in a data breach that occurred earlier this year and nobody had disclosed.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, DHS) facebook linkedin twitter Cybercrime data breach DHS Hacking hacking news IT Information Security Pierluigi Paganini Security Affairs Security News
organisation IT Information Security
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, DHS) facebook linkedin twitter Cybercrime data breach DHS Hacking hacking news IT Information Security Pierluigi Paganini Security Affairs Security News
organisation Security Affairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, DHS) facebook linkedin twitter Cybercrime data breach DHS Hacking hacking news IT Information Security Pierluigi Paganini Security Affairs Security News
organisation Microsoft 365
The records reveal access to tools including Microsoft 365, ChatGPT, Penlink surveillance software and Mobile Fortify, a facial recognition app used by CBP and ICE.
organisation Mobile Fortify
The records reveal access to tools including Microsoft 365, ChatGPT, Penlink surveillance software and Mobile Fortify, a facial recognition app used by CBP and ICE.
organisation Hacker
Hacker leaks data on more than 40,000 Homeland Security employees.
organisation Homeland Security
Hacker leaks data on more than 40,000 Homeland Security employees.
victims 40,000 Security employees
Hacker leaks data on more than 40,000 Homeland Security employees.
Hacker leaks data on more than 40,000 Homeland Security employees A hacker leaks personal data on more than 40,000 DHS employees, including CBP, ICE and CISA staff, after an undisclosed breach.
organisation DHS
Hacker leaks data on more than 40,000 Homeland Security employees A hacker leaks personal data on more than 40,000 DHS employees, including CBP, ICE and CISA staff, after an undisclosed breach.
organisation CBP
Hacker leaks data on more than 40,000 Homeland Security employees A hacker leaks personal data on more than 40,000 DHS employees, including CBP, ICE and CISA staff, after an undisclosed breach.
organisation Department of Peace
The hacker, who uses the name Department of Peace, claims to have stolen the data from an Okta single sign-on system.
organisation TechCrunch
The hacker left a note with the leaked data, seen by TechCrunch, saying that if others have their information, it is only fair to share theirs.
organisation U.S. Customs and Border Protection
More than half of the records, around 21,000, belong to U.S. Customs and Border Protection (CBP) employees working at airports and other ports of entry.
organisation Immigration and Customs Enforcement
Another 10,000 belong to Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations unit, while just under 1,000 are linked to the cybersecurity agency CISA.
organisation U.S. Citizenship and Immigration Services
Thousands of other records belong to DHS headquarters and agencies such as U.S. Citizenship and Immigration Services and the Federal Protective Service.
organisation the Federal Protective Service
Thousands of other records belong to DHS headquarters and agencies such as U.S. Citizenship and Immigration Services and the Federal Protective Service.
organisation FOIA
They said it could also support investigations and future Freedom of Information Act (FOIA) requests.
organisation Icepick
“Rather than an indiscriminate directory of every DHS employee, Icepick identifies many of the architects and drivers of DHS policy and operations,” said journalist and DDoSecrets cofounder Emma Best.
organisation BlueLeaks
“The leak is extraordinary but deceptive in its simplicity as it identifies the officials responsible for overseeing covert and undercover operations, the government’s hunt for leakers and the failed BlueLeaks investigation — along with key personnel in DHS’s ever-escalating rendition and deportation programs.”
organisation Headspace
Around 4,500 accounts belong to a Headspace user group, while more than 2,000 Homeland Security Investigations employees appear in Penlink-related groups.
victims 220,000 employees
The leak covers about one-fifth of DHS’s 220,000 employees.
Tactical Metrics
Metrics
infrastructure
‎Microsoft 365
Affected Product
The records reveal access to tools including Microsoft 365, ChatGPT, Penlink surveillance software and Mobile Fortify, a facial recognition app used by CBP and ICE.
Metrics
victims
40,000
Security Employees
Hacker leaks data on more than 40,000 Homeland Security employees.
Hacker leaks data on more than 40,000 Homeland Security employees A hacker leaks personal data on more than 40,000 DHS employees, including CBP, ICE and CISA staff, after an undisclosed breach.
Metrics
victims
220,000
Employees
The leak covers about one-fifth of DHS’s 220,000 employees.
Intelligence Sources
Security Affairs 2026-10-30