DHS Leaks Data on 40,000 Staff

A hacktivist group released personal information for more than 40,000 employees of the U.S. Department of Homeland Security on Wednesday. The data, posted by Distributed Denial of Secrets, includes names, phone numbers, and email addresses. It also contains job titles and internal email group assignments.

The release covers staff from several major components, including Immigration and Customs Enforcement, Customs and Border Protection, and the Cybersecurity and Infrastructure Security Agency. The dataset specifically identifies agents assigned to surveillance, computer forensics, and undercover roles. This level of detail exposes the internal structure of sensitive divisions within the agency.

Distributed Denial of Secrets co-founder Emma Best stated that a hacker known as "maia arson crimew" built a search tool for the public. Best argued that the tool would "replace anonymity with accountability" and help journalists guide public records requests. The group says the data came from an entity calling itself the "Department of Peace."

The Department of Peace claimed it harvested the information from Okta, a sign-on service used by DHS. Best said the group believes DHS employees hold personal data on the public, making the exchange fair. However, Okta responded to a query by stating its systems remain secure and that it has no evidence of a compromise.

DHS acknowledged the incident in a statement, saying it was "aware of a potential breach and is actively working to address the situation swiftly and effectively." The agency promised to update the public when more information becomes available. It did not specify the exact date the breach occurred or the full scope of the damage.

Reuters could not verify the entire dataset but confirmed the details of six named employees against credit bureau records. Reporters called three of those employees directly to verify their phone numbers. One employee said they had not heard of a breach before the leak went public.

This is the third major federal data exposure in the past month. In September, the group ShinyHunters claimed to have stolen FBI employee data. Last week, a class-action lawsuit was filed after a breach exposed data on millions of current and former military personnel at the U.S. War Department.