Personally identifiable information belonging to tens of thousands of U.S. Department of Homeland Security employees has surfaced online following a security breach earlier this year. The compromised records include names, official job titles, and internal work contact details such as office locations, cell phone numbers, and email addresses for more than 40,000 federal workers, covering immigration agents, border personnel, cybersecurity professionals, and senior department officials.
Operating under the moniker Department of Peace, the hacker asserted that the information was extracted from an Okta single sign-on system utilized by the agency to authenticate employees and contractors across its central network. This infrastructure also maintained IT records and user account login histories detailing internal applications and systems accessible to individual staff members. Approximately 21,000 of the leaked records involve personnel from U.S. Customs and Border Protection stationed at airports and ports of entry, while another 10,000 records point to employees within Immigration and Customs Enforcement and its Homeland Security Investigations unit. An additional thousand records affect the Cybersecurity and Infrastructure Security Agency, alongside personnel from headquarters and the Federal Protective Service.
The unauthorized data dump represents the latest in a series of high-profile security incidents impacting federal agencies, following prior breaches involving military personnel records and FBI agent directories. Independent verification of a subset of the database confirmed its authenticity by cross-referencing names against known federal staff lists. Timestamps embedded within the files indicate the data was exfiltrated around mid-August, representing roughly one-fifth of the total Homeland Security workforce.
Beyond basic contact details, the leaked dataset sheds light on the internal software and surveillance tools accessible to agency staff through Active Directory user groups. Entries detail permissions for standard productivity suites alongside specialized contracts, including references to user groups linked to web surveillance tools and historical mental health software provisions. Representatives for Okta maintained that their platform remains secure and noted no evidence of system compromises, while officials from the Department of Homeland Security did not immediately respond to requests for comment.
Comments