A hacker has published information belonging to more than 40,000 U.S. Department of Homeland Security (DHS) employees following an alleged data breach earlier this year.
Records involve personnel from several federal agencies, including Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP) and the Cybersecurity and Infrastructure Security Agency (CISA).
According to the hacker, the information came from a system used to manage employee access to internal applications. DHS is investigating the incident, although questions remain about how the data was obtained and whether other systems were affected.
Why It Matters: Identity management platforms contain valuable information about how employees access enterprise systems. When those records are exposed, attackers may be able to identify accounts with sensitive permissions or use internal details to develop more convincing phishing attempts. For organizations relying on centralized identity services, understanding who can retrieve employee information and how access is controlled across connected applications is an important part of managing security risks.
- Thousands of Federal Employees Are Affected: More than half of the leaked records involve CBP personnel, with approximately 10,000 others associated with ICE and Homeland Security Investigations. The remaining information covers employees across DHS, including nearly 1,000 CISA staff members. In addition to contact details, some records identify employees’ managers and office assignments, providing information about how personnel are organized within the department.
- The Hacker Claims to Have Accessed an Okta System: Department of Peace, the name used by the hacker, says the information came from an Okta single sign-on environment used by DHS employees and contractors. The platform helps manage access to applications across the department. However, Okta says it has found no evidence that its own systems were compromised. Investigators have not confirmed how the records were obtained or whether the attacker accessed an account or another service connected to the platform.
- Internal Technology Access Was Also Exposed: The leaked information includes Active Directory group memberships associated with applications used across DHS. Some reference Penlink, a company that provides surveillance technology, while others involve Mobile Fortify, a facial-recognition application used by immigration authorities. One Penlink-related group included more than 2,000 users, and another identified over 200 CBP personnel associated with Mobile Fortify. These records indicate which employees may have access to certain tools, although they do not establish whether those applications were actively used.
- The Data May Have Been Stolen Months Ago: Timestamps suggest the information was extracted around mid-August, more than two months before it appeared online. DHS has acknowledged the potential breach and says it is working to address the situation. Officials have not disclosed when the department first learned of the incident or whether the security weakness has been resolved. The full extent of the attack remains under investigation.
- The Breach Follows Other Federal Security Incidents: Recent reports of stolen FBI personnel information and military records maintained by the Pentagon have added to concerns about federal data security. Department of Peace also claimed responsibility for obtaining DHS contracts earlier this year. While no connection between the incidents has been established, the latest exposure adds to a series of government data thefts involving employee information and internal records.
Trump’s speeches take on darker tone and DHS hack exposes 40,000 workers: Morning Rundown – NBC News
