A reported cybersecurity breach has exposed employment and contact information linked to more than 40,000 US Department of Homeland Security personnel, including staff from CBP, ICE and CISA. The incident has raised concerns about employee privacy and the security of government identity systems.

What Happened?

A hacker has reportedly obtained and published a large collection of personnel records associated with the US Department of Homeland Security (DHS), according to a report by TechCrunch.

The exposed information includes employee names, job titles, work email addresses, phone numbers and office locations. The dataset reportedly contains records belonging to personnel across several government agencies responsible for border security, immigration enforcement and cybersecurity.

The hacker, operating under the name Department of Peace, claimed to have obtained the information through an Okta single sign-on system used by DHS employees and contractors to access the department’s network.

The full circumstances of the incident remain unclear. DHS has acknowledged a potential breach and said it is working to address the situation.

Which US Government Agencies Are Affected?

The leaked dataset reportedly contains records from multiple agencies operating under DHS.

Key agencies represented in the data include:

  • US Customs and Border Protection (CBP): Approximately 21,000 records reportedly relate to personnel working at airports, border crossings and other ports of entry.
  • Immigration and Customs Enforcement (ICE): Around 10,000 records are associated with ICE and its Homeland Security Investigations unit.
  • Cybersecurity and Infrastructure Security Agency (CISA): Nearly 1,000 records reportedly relate to personnel at the federal cybersecurity agency.
  • Other DHS offices: Additional records concern headquarters employees, US Citizenship and Immigration Services and the Federal Protective Service.

According to the report, the total number of records is equivalent to roughly one-fifth of the department’s workforce, which is estimated at approximately 220,000 employees.

However, the exposed records do not necessarily represent unique individuals, and the precise number of affected employees has not been independently confirmed by DHS.

How Was the Information Reportedly Obtained?

The hacker claimed that the information came from an Okta single sign-on system associated with DHS.

Single sign-on, commonly known as SSO, allows employees to access multiple workplace applications using a centralized authentication system. Organizations use these systems to simplify account management and control access to internal services.

The reported dataset contains more than basic employee directory information. It also reportedly includes account-related records and details about user groups, which can indicate the internal applications and services employees are authorized to access.

TechCrunch said it verified a portion of the records by comparing employee names with an offline copy of the database. Timestamps in the records suggested that the information may have been extracted around mid-August.

The available information does not establish precisely how the hacker gained access, whether a vulnerability was exploited, or whether the same access method remains possible.

DHS and Okta Respond to the Incident

Following publication of the report, a DHS spokesperson said the department was aware of a potential breach and was working to address it. The department also stated that threats against its employees and officers were being taken seriously.

Okta, meanwhile, said it was aware of the report and had no evidence that its own data or systems had been compromised.

The distinction is important because the reported exposure involves an identity system used by DHS, but that does not by itself establish that Okta’s infrastructure was breached.

Investigators will need to determine how the information was accessed, whether any additional systems were affected and what measures are necessary to prevent further exposure.

Leaked Records Reveal Details About Government Technology

Beyond employee contact information, the dataset reportedly provides insight into some of the software and technology services available to DHS personnel.

According to the report, the records contain information about user groups connected to internal systems and third-party applications. These include common workplace tools such as Microsoft 365, Adobe Acrobat and Citrix.

The data also reportedly references technologies used for investigations, surveillance and identity verification.

Among the examples described in the report are:

  • Penlink: A company providing digital intelligence and surveillance technology, including tools associated with mobile-device data.
  • Mobile Fortify: A facial-recognition application reportedly used by some CBP and ICE personnel to help identify individuals and verify information.
  • Headspace: A mental wellness platform associated with a previous federal contract for mental health software intended for certain ICE employees.
  • ChatGPT: The records reportedly include user groups associated with access to the AI service.

These entries do not necessarily prove that every listed employee actively used a particular application or that every historical access group remains operational. A membership record can indicate authorization or association rather than actual usage.

Headspace told TechCrunch that it had not provided services to DHS or ICE since 2023. Penlink did not respond to the publication’s request for comment, according to the report.

Why the Breach Raises Cybersecurity Concerns

Government personnel directories may appear less sensitive than classified documents, but the exposure of employee identities and work contact details can create significant security risks.

Attackers may use this information to prepare convincing phishing messages, impersonate colleagues or target employees with fraudulent login requests. Details about internal access groups can also help malicious actors understand an organization’s technology environment.

The risk may be greater when records concern personnel working in law enforcement, border security or cybersecurity roles.

However, the publication of employee information does not automatically mean that government systems have been compromised further or that operational data has been accessed. Those possibilities require separate investigation.

The incident highlights the importance of protecting identity systems, monitoring unusual account activity, limiting access privileges and responding quickly when employee information is exposed.

A Series of Reported US Government Data Breaches

The DHS incident follows other reported breaches involving US government personnel information.

Recent reports have described the theft of FBI agents’ personnel records and the exposure of information associated with current and former military personnel through a Pentagon human resources unit.

The latest incident also follows an earlier claim by the same hacker that information concerning DHS contracts with private-sector companies had been obtained.

Taken together, these reports have increased attention on the cybersecurity of government databases, identity platforms and systems containing employee information.

Nevertheless, each incident requires its own technical investigation to establish the method of access, the extent of the exposure and the security measures that may have failed.

What Happens Next?

Several important questions remain unanswered, including how the hacker accessed the records, whether the department has closed the route used to obtain them and whether any additional information was stolen.

DHS will need to establish the scope of the incident, assess potential risks to affected personnel and determine whether further security measures are required.

Security teams may also need to review authentication logs, account permissions, access histories and monitoring systems to identify suspicious activity.

For organizations beyond government, the incident serves as a reminder that identity and access management platforms are critical security assets. Protecting them requires strong authentication, careful permission management and continuous monitoring.

Conclusion

The reported exposure of more than 40,000 DHS personnel records highlights the potential consequences of a breach involving government identity systems. Information linked to CBP, ICE, CISA and other agencies has reportedly appeared online, although the full scope and technical cause of the incident remain unclear.

DHS says it is responding to the potential breach, while Okta has stated that it has no evidence its own systems were compromised. Further investigation will be needed to determine how the data was obtained and whether additional government systems or personnel face risks.

The incident underscores why protecting employee information and controlling access to internal systems remain essential parts of cybersecurity.