Hacktivist Leak Exposes 41,000 DHS Personnel Records

Names, job titles, work email addresses, phone numbers, office locations, and tool-access rights for more than 41,000 DHS employees were published online by a hacktivist group called "Department of Peace". The dump includes records for ICE agents, CBP staff, and CISA employees.

More than half of the leaked records belong to US Customs and Border Protection employees, typically stationed at airports, seaports, and land border crossings. Around 10,000 ICE employees and nearly 1,000 CISA staff were also exposed.

The group claims to have extracted the data from an Okta single sign-on system that DHS staff use to log onto the central network. Okta has stated it has not seen evidence of a compromise in its own systems.

The leak lists access rights to Palantir Falcon, PenLink, and Mobile Fortify, a facial-recognition app used by immigration agents, alongside everyday office software.

The exposed contact details can be used for spear-phishing, social engineering, or to target agents with tailored malware. The presence of tool-access metadata could aid attackers in crafting credential-replay or privilege-escalation attacks.

1. Review Okta audit logs for anomalous activity and verify that only authorized applications are listed.
2. Enforce least-privilege access policies and remove any unused or excessive permissions.
3. Deploy multi-factor authentication for all staff, especially those with access to sensitive tools.
4. Conduct a rapid phishing awareness campaign and monitor for suspicious emails or calls.
5. Coordinate with the FBI and CISA to assess potential operational impacts.

Centralizing identity in a single cloud provider creates a high-value target. The incident highlights the need for continuous monitoring, segmentation of identity services, and rigorous access reviews.

The same hacktivist group previously claimed to breach DHS contracts with over 6,000 firms, including L3Harris, Raytheon, Palantir, Microsoft, and Oracle. Earlier incidents, such as the ShinyHunters breach of FBI personnel data, demonstrate a pattern of targeting U.S. government personnel.

Companies that provide services to DHS should audit their integrations with Okta, verify that only necessary scopes are granted, and monitor for anomalous token usage. They should also review their own incident response plans for potential supply-chain implications.

An internal investigation is underway to determine the extent of the Okta compromise, assess potential credential reuse, and evaluate the risk to ongoing investigations. DHS will likely engage external forensic experts and coordinate with federal law-enforcement agencies.

For a deeper dive into the Okta breach mechanics and potential mitigations, see the Zero-Day Vulnerability & CVE Exploit Matrix.