Hacker leaks data on 40,000 Homeland Security employees including CBP and ICE agents

How the breach occurred

A hacker operating under the alias Department of Peace claimed responsibility for stealing and publishing the data. According to TechCrunch, the breach targeted an Okta single sign-on (SSO) system used by the U.S. Department of Homeland Security (DHS). The hacker justified the action as retaliation for government access to public information.

The stolen records include names, job titles, email addresses, phone numbers, office locations, and access details to internal systems like Microsoft 365, Adobe Acrobat, and surveillance tools such as Penlink PLX and Mobile Fortify. The data was exfiltrated in mid-August and represents roughly one-fifth of DHS’s total workforce.

Scope of the leaked data

The leaked dataset contains over 40,000 records, with more than half—around 21,000—belonging to U.S. Customs and Border Protection (CBP) employees. Nearly 10,000 records pertain to Immigration and Customs Enforcement (ICE) and Homeland Security Investigations (HSI) staff, while close to 1,000 relate to employees of the Cybersecurity and Infrastructure Security Agency (CISA).

The breach also exposed details about internal tools and partnerships. For example, around 4,500 ICE agents and deportation officers were listed as members of a group tied to Headspace, a mental health app, though the company confirmed it has not provided services to DHS or ICE since 2023. Other records reveal access to surveillance technologies like Penlink PLX, which is used to track location data and analyze real-time intelligence from phone calls, texts, and social media.

TechCrunch verified the authenticity of the data by cross-referencing known DHS employee names with the leaked records.

Response and implications

Okta denied any compromise of its systems, stating that the breach did not originate from its infrastructure. The hacker, Department of Peace, previously claimed responsibility for another breach involving Homeland Security earlier this year, which exposed thousands of contracts between the department and private-sector entities.

The data was shared with journalist and hacker maia arson crimew, who then provided it to DDoSecrets, a transparency organization. Emma Best, co-founder of DDoSecrets, described the leak as a potential "catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action, and Freedom of Information Act requests."

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This breach underscores the vulnerabilities in single sign-on systems used by government agencies, particularly for organizations handling sensitive surveillance and law enforcement tools. For founders and operators, the incident highlights the risks of third-party integrations—especially those tied to identity and access management (IAM) providers like Okta. If a federal agency with significant cybersecurity resources can face such a breach, smaller organizations must reassess their own IAM policies, multi-factor authentication (MFA) enforcement, and employee data protection measures.

Related on Lazyfounder

• More policy news
• Microsoft