Hacker Leaks 40,000 DHS Employees' Data: 'They Have Ours, So It's Only Fair'

What Got Stolen, And From Whom

The breach, first reported by TechCrunch, hit a single sign-on system that DHS uses to let employees and contractors log into its central network. According to the hacker, it was an Okta system. That system holds not just contact details but also IT and log-in records, including which internal systems and apps each employee is allowed to touch.

The numbers are big. Roughly 21,000 of the records belong to Customs and Border Protection staff. Another 10,000 are ICE and its Homeland Security Investigations unit. Just under 1,000 work at CISA, the agency whose literal job is defending the country's cybersecurity. Thousands more come from DHS headquarters, Citizenship and Immigration Services, and the Federal Protective Service.

That adds up to about one-fifth of DHS's entire 220,000-person workforce. The records appear to have been pulled around mid-August, based on timestamps. TechCrunch verified a portion of the data by matching known DHS employees against an offline copy of the database.

A Hacker With A Peace Sign And A Grudge

The hacker, who goes by Department of Peace, didn't answer TechCrunch's questions about how the breach happened. Nobody has been told whether the hole has been patched. Nobody has been told whether DHS even knows it was robbed.

The data went to journalist and hacker maia arson crimew, who passed a copy to DDoSecrets, a nonprofit that hosts leaked datasets in the public interest. So this is not sitting in some dark corner of the internet waiting to be discovered. It is out. It is hosted. It is searchable by people with free time and opinions.

And this is not the hacker's first visit. The same person previously claimed to have taken thousands of contracts between DHS and private companies, including defense contractors and surveillance vendors. Two breaches in one year, same intruder. At some point you stop calling it a hack and start calling it a subscription.

The Okta Shrug

Okta, for its part, said it is aware of the report and offered a statement that sounds like it was written by a lawyer holding a fire extinguisher: "Okta is secure, and we have no evidence our data or systems were compromised."

Note what that does and doesn't say. It doesn't say DHS's login system wasn't breached. It says Okta's own systems weren't, which is a very different claim. If a burglar walks through your neighbor's unlocked back door, that's not a statement about your locks. It's also not a statement that anyone in the house is safe.

DHS did not immediately respond to TechCrunch's request for comment. Which, given the track record, tracks.

Another Week, Another Federal Database Cracked Open

This is part of a pattern, and not a flattering one. Earlier hacks involved thousands of FBI agents' personnel records and the personal information of millions of current and former military service members from the Pentagon's human resources unit. Now it's DHS, twice.

The federal government is currently the most expensive, most heavily armed, and most leaky organization in American life. It can track hundreds of millions of phones, but it apparently cannot keep its own employee directory from walking out the front door.

This lands at an awkward moment. DHS's deportations, arbitrary detentions, and killings of U.S. citizens under its leadership have become a major issue for voters ahead of the midterms. The agency that has spent the year demanding more data on everyone else is now explaining, or more likely not explaining, how it lost its own.

What The Leaked Directory Says About The Machine

Here's where it gets genuinely revealing. The dataset includes Active Directory group memberships, which control who can access which tools. That means it doubles as a rare, if incomplete, map of what DHS employees are plugged into.

Around 4,500 users, including ICE agents and deportation officers, belong to a group called "Headspace_users." Headspace once held an $82,500 federal contract with ICE, ended in 2023, to fund mental health software for ERO employees, the deportation unit. A Headspace spokesperson said the company has provided no services to DHS or ICE since 2023. So thousands of people are still in the group for a contract that's been dead for three years. Government efficiency, everyone.

Dozens of other groups reference Penlink, a web surveillance company whose technology it claims can track location data from hundreds of millions of mobile devices. Some groups have a handful of users in local offices. One has more than 2,000 users across HSI nationally. One references Penlink PLX, which the company says captures and analyzes "real-time intelligence" from calls, texts, web activity, and social media. Penlink didn't respond to a request for comment.

Another group covers more than 200 CBP users tied to Mobile Fortify, a facial-recognition app used by both CBP and ICE agents to identify people.