# Homeland Security Personnel Data Stolen in Major Cybersecurity Breach Hackers exfiltrated sensitive records of 40,000 employees via an Okta single sign-on system. - **Source:** [TechCrunch](https://techcrunch.com) - **Published:** 2026-10-28 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/649bdefc-34d2-4976-a693-a5a6b2e6bfe5 ## Massive Federal Data Exposure A hacker operating under the handle Department of Peace compromised the U.S. Department of Homeland Security, exposing records of 40,000 employees. The leaked dataset includes names, job titles, email addresses, and office locations. This breach represents approximately one-fifth of the agency's total workforce, impacting personnel across multiple critical federal departments. ## Okta System Vulnerability The attacker claimed to have obtained the data through an Okta single sign-on system used by the department. This platform manages employee logins and access permissions for internal applications. While the hacker asserts this entry point, Okta stated they have no evidence their own systems or data were compromised during this incident. ## Scope of Impacted Agencies The breach disproportionately affects U.S. Customs and Border Protection with 21,000 records exposed. Additionally, 10,000 records belong to Immigration and Customs Enforcement and its investigative unit. Smaller groups of affected staff include personnel from CISA, U.S. Citizenship and Immigration Services, and the Federal Protective Service, highlighting the broad reach of the intrusion. ## Internal Access and Tooling The leaked data reveals employee membership in Active Directory user groups, which control access to internal tools. Many employees were linked to Microsoft 365, Adobe, and Citrix environments. The records also detail access to specialized software, including facial-recognition apps like Mobile Fortify and surveillance technologies provided by contractors such as Penlink. ## Contractor and Software Ties The dataset highlights connections to third-party services, including a group for Headspace users, despite the company ending its contract with ICE in 2023. Other groups reference Penlink PLX, a surveillance tool used for capturing real-time intelligence from mobile devices. These details provide rare insight into the operational tech stack of federal agencies. ## Verification and Data Origin TechCrunch verified the authenticity of the data by matching known employee names against the leaked database. Timestamps on the records suggest the exfiltration occurred in mid-August. The data was provided to journalist maia arson crimew and subsequently hosted by DDoSecrets, a nonprofit collective that publishes leaked datasets in the public interest. ## Broader Security Context This incident follows a series of high-profile government hacks, including the theft of FBI personnel records and Pentagon human resources data. It marks the second time this year that Homeland Security has been targeted by the same hacker, who previously claimed to have stolen thousands of contracts between the department and private vendors. ## Implications for Transparency Transparency advocates suggest the leaked contact information could serve as a catalyst for future Freedom of Information Act requests. By identifying specific agents and their internal tool access, researchers aim to investigate alleged abuses. The exposure provides a rare, albeit unauthorized, view into the scale and operations of federal immigration and security agencies. ## Sources covering this story - https://techcrunch.com/2026/10/28/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-agents/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._