The dataset covers border and immigration agents, cybersecurity staff, and senior officials. The largest groups are:
- More than 21,000 records for U.S. Customs and Border Protection (CBP) employees
- About 10,000 records for Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations unit
- Just under 1,000 records for the cybersecurity agency CISA
- Additional staff from DHS headquarters and agencies such as U.S. Citizenship and Immigration Services
The hacker goes by “Department of Peace” and says the records were pulled from an Okta system that DHS employees and contractors use to reach the department’s central network. Timestamps on the records point to a breach around mid-August. “They have our information, so it’s only fair that we have theirs,” the hacker wrote in a note posted with the data.
The leak also includes IT and log-in records showing which internal systems and applications each employee can access. Okta said it was aware of the report but sees “no evidence our data or systems were compromised.” DHS has not responded to requests for comment. TechCrunch verified parts of the data, which gives an incomplete picture of the department’s operations.
The Access Groups Say More Than the Names Do
Most employees in the records had access to Microsoft 365, Adobe Acrobat, and Citrix, and Microsoft 365 access is a familiar target for account takeover. The more specialized groups are where the records get revealing.
About 4,500 users, including ICE agents, sat in a “Headspace_users” group. Headspace held an $82,500 federal contract with ICE for “mental health software” that ended in 2023. Dozens of groups referenced Penlink, a web surveillance company whose technology it says tracks mobile device location data and analyzes real-time intelligence. More than 200 CBP users were tied to Mobile Fortify, a facial-recognition app agents use to identify people and verify immigration status. Some senior officials had ChatGPT access, and other groups were linked to investigations of China-backed hacking groups such as Salt Typhoon.
Transparency advocates see the dataset as a research tool. Ryan Shapiro, executive director of Property of the People, said “Email addresses and phone numbers are indispensable tools for FOIA researchers,” since they turn vague requests into targeted ones. Emma Best, co-founder of DDoSecrets, expects the data to be a “catalyst for investigations,” including congressional inquiries and legal challenges.
The breach also fits a run of attacks on federal data. Hackers recently took FBI agents’ personnel records and millions of military personnel records from the Pentagon. The same hacker also claimed an earlier DHS breach involving contract data.
Hashlytics Take
The names will get the attention, but the group memberships are the part that ages worst for DHS. A list of who can reach which system is effectively a map of who to impersonate and where to aim a phishing message, and it stays useful long after anyone has rotated a password. Okta’s statement is also narrower than it sounds. “No evidence our data or systems were compromised” speaks to Okta’s own infrastructure, not to how a customer’s tenant was configured or which account was abused, so it does not tell us how the records walked out. Until DHS explains that, the open question is whether this was a vendor failure or an access-control failure inside the department, and those lead to very different fixes.
Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates