INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

DHS Employee Records Leaked Online

| 2026-10-29 12:54 CRITICAL HIGH DATA BREACH
JSON
Executive Summary
AI-generated
A threat actor has leaked online a database containing the personal and work information of thousands of US Department of Homeland Security employees, with over 41,000 records exposed. The hacker, using the handle "Department of Peace", claims to have stolen data from an Okta single sign-on system used by DHS employees and contractors. Most of the leaked records reportedly contain information on US Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), and Homeland Security Investigations (HSI) employees, as well as 1,000 CISA employees. The compromised data includes names, work email addresses and phone numbers, job titles, and office locations, with an online tool to search the data also available. The incident surfaced one month after ShinyHunters breached FBI systems and three months after Homeland Security Information Network (HSIN) was hacked.
Technical Mitigations AI-generated
• Patch Okta's single sign-on system to address the reported breach. • Block access to systems and internal applications for employees whose information was leaked online. • Hunt for indicators of compromised accounts, such as which employees have access to sensitive systems.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters
Target & Sectors
NORTH_AMERICA NORTH_AMERICA governmentgovernment
Incident Timeline
‎2026/10/29
A threat actor using the handle Department of Peace leaked a database containing personal and work information of thousands of US Department of Homeland Security employees online.
organisation US Department of Homeland Security
A threat actor has leaked online a database containing the personal and work information of thousands of US Department of Homeland Security employees.
organisation US Customs
Most of the leaked records reportedly contain information on US Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), and Homeland Security Investigations (HSI) employees.
organisation CBP
Most of the leaked records reportedly contain information on US Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), and Homeland Security Investigations (HSI) employees.
organisation Immigration and Customs Enforcement
Most of the leaked records reportedly contain information on US Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), and Homeland Security Investigations (HSI) employees.
organisation Homeland Security
Most of the leaked records reportedly contain information on US Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), and Homeland Security Investigations (HSI) employees.
organisation HSI
Most of the leaked records reportedly contain information on US Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), and Homeland Security Investigations (HSI) employees.
threat_actor ShinyHunters
The incident surfaced one month after the infamous extortion group ShinyHunters breached FBI systems , and three months after the Homeland Security Information Network (HSIN) was hacked .
organisation the Homeland Security Information Network
The incident surfaced one month after the infamous extortion group ShinyHunters breached FBI systems , and three months after the Homeland Security Information Network (HSIN) was hacked .
organisation Pentagon Personnel Agency Data
Related: Pentagon Personnel Agency Data Breach Impacts 3 Million People Related: HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million Related: One Compromised Login Exposed Millions of California Students’ Records Related: Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court System
organisation iRhythm Data Breach Toll
Related: Pentagon Personnel Agency Data Breach Impacts 3 Million People Related: HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million Related: One Compromised Login Exposed Millions of California Students’ Records Related: Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court System
organisation Arizona’s Court System
Related: Pentagon Personnel Agency Data Breach Impacts 3 Million People Related: HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million Related: One Compromised Login Exposed Millions of California Students’ Records Related: Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court System
organisation DHS
Over 41,000 DHS Employee Records Leaked Online.
data_breach 41,000 DHS Employee Records
Over 41,000 DHS Employee Records Leaked Online.
The hacker, who uses the handle Department of Peace, has leaked more than 41,000 records.
organisation Department of Peace
The hacker, who uses the handle Department of Peace, has leaked more than 41,000 records.
organisation Illumio
If an attacker knows which employees have access to which systems and applications, they’ve essentially been handed a roadmap for where to go next and who to target to get there,” said Illumio public sector CTO Gary Barlet.
victims 1,000 CISA employees
Roughly 1,000 CISA employees, along with personnel at several other DHS agencies, had their information leaked as well.
Tactical Metrics
Metrics
data_breach
41,000
Dhs Employee Records
Over 41,000 DHS Employee Records Leaked Online.
The hacker, who uses the handle Department of Peace, has leaked more than 41,000 records.
Metrics
victims
1,000
Cisa Employees
Roughly 1,000 CISA employees, along with personnel at several other DHS agencies, had their information leaked as well.
Intelligence Sources
SecurityWeek 2026-10-29