US Homeland Security Data Breach Exposes Personal Details of Over 41,000 Employees

A newly disclosed data leak has exposed personal and professional information on more than 40,000 U.S. Department of Homeland Security employees, including personnel in surveillance, human intelligence, and undercover operations. Distributed Denial of Secrets announced the publication on October 28. It attributed the information to an entity calling itself “Department of Peace.”

The reported exposure raises concerns about employee safety, targeted impersonation, and the disclosure of sensitive organizational relationships.

According to Reuters, the records contain names, telephone numbers, email addresses, job titles, and internal email groups. Affected components include Immigration and Customs Enforcement, Customs and Border Protection, Homeland Security Investigations, and the Cybersecurity and Infrastructure Security Agency.

Some entries identify assignments involving special operations, computer forensics, surveillance, and undercover work, making the exposure more consequential than a conventional employee contact-directory leak.

US Homeland Security Data Breach

Distributed Denial of Secrets co-founder Emma Best said the Department of Peace harvested information from the Okta single sign-on service DHS uses.

However, Reuters could not independently corroborate that account. Okta rejected suggestions that its infrastructure was breached, stating, “Okta is secure, and we have no evidence our data or systems were compromised.” The available reporting therefore does not establish an Okta platform vulnerability or a confirmed initial-access technique.

That distinction is technically important: an allegation involving a customer’s identity environment does not establish compromise of the identity provider itself.

Separately documented identity-focused social engineering attacks illustrate how adversaries can manipulate employees or help desks into resetting authentication factors and granting account access. Those techniques provide relevant defensive context, but investigators have not publicly linked them to this DHS disclosure. Attribution and the precise extraction mechanism remain unresolved.

Reuters could not authenticate the entire dataset but matched information concerning six employees against credit bureau records and previously exposed information accessible through intelligence platform District 4 Labs. Reporters also contacted three DHS employees and confirmed telephone numbers and other details.

One employee said the call was their first notification of a possible breach. These checks substantiate individual records but do not validate every entry or the claimed collection method.

Some disclosed information overlapped with employees’ LinkedIn profiles. Other records reportedly exposed nonpublic organizational structures and previously undisclosed programs or operations.

Best-known journalist and hacktivist Maia Arson developed a searchable interface and presented it as a resource for reporting, public-records requests, and oversight. Making sensitive roles searchable also creates potential opportunities for highly personalized impersonation and reconnaissance against affected personnel.

For defenders, the immediate concern extends beyond exposed contact details to their potential use in convincing support-desk requests and targeted calls. Reporting on enterprise vishing platforms shows how attackers combine employee names, titles, and telephone numbers with real-time credential harvesting.

Relevant safeguards include independently verifying password and MFA-reset requests, reviewing suspicious authenticator enrollments, and correlating identity logs with unusual application access. These are precautionary measures, not evidence that vishing caused the DHS incident or that exposed employees’ accounts have subsequently been compromised.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.