Records identifying more than 41,000 employees of the U.S. Department of Homeland Security have been published online after a hacktivist group claimed it obtained personnel data from an Okta single sign-on service used by the department. The dataset includes names, job titles, office locations and work contact details such as email addresses and phone numbers, according to TechCrunch’s investigation. The publication follows a separate intrusion involving a U.S. government network disclosed last year.
The group calling itself Department of Peace said it obtained the information from an Okta identity system used by DHS employees and contractors. Cybernews counted 41,191 records spanning nine agencies and nearly 7,000 offices. The dataset includes personnel associated with Customs and Border Protection, Immigration and Customs Enforcement, Homeland Security Investigations, U.S. Citizenship and Immigration Services, the Cybersecurity and Infrastructure Security Agency and other DHS units. These figures describe records in the published dataset, not a confirmed count of unique current employees; the search tool built around the data warns that the list is incomplete and may contain inaccuracies.
Some records also contain Active Directory and Okta group memberships, which can reveal organizational affiliations and the internal services available to employees. Cybernews reported that the data may expose links to sensitive assignments, but neither DHS nor an independent government investigation has publicly confirmed the full scope or accuracy of those details. The leaked material has not been reproduced here, and no individual employee records are being identified.
DHS told TechCrunch it was aware of a potential breach and was working to address the situation, adding that it would provide more information when available. The department has not publicly confirmed how the data was accessed or whether the reported access path has been closed. Reuters also reported that Okta had no evidence its own data or systems were compromised, distinguishing the reported exposure of information in a DHS identity environment from a confirmed breach of Okta’s corporate infrastructure.
TechCrunch said it verified a portion of the records by matching names against known DHS employees and that timestamps in the dataset suggest the information was taken around mid-August. The data was shared with the nonprofit Distributed Denial of Secrets and journalist maia arson crimew before being published.
On October 29, Reuters reported that DHS had asked Icelandic hosting provider FlokiNET to remove or restrict access to the leaked data, warning that it could expose more than 40,000 personnel to harassment, stalking and physical harm. The request was submitted through ZeroFox, which is authorized by Immigration and Customs Enforcement to seek content removals. FlokiNET’s chief executive said the company would not take the data down because it contained employees’ work addresses and phone numbers rather than personal contact details.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
