40,000 Homeland Security Records Leaked by Non-Profit Group
The disclosure includes contact details and internal job assignments for agents in surveillance and special operations, marking the third major federal data breach in one month.
By Dominic Foster ·
A non-profit data transparency group released personal and professional records for more than 40,000 Department of Homeland Security employees on Wednesday. The data, posted by Distributed Denial of Secrets, includes names, phone numbers, and email addresses for personnel across multiple agencies.
The records extend beyond basic contact information. They list job titles and email group memberships that reveal specific assignments in surveillance, human intelligence, computer forensics, and undercover operations. The affected agencies include Immigration and Customs Enforcement, Customs and Border Protection, and the Cybersecurity and Infrastructure Security Agency.
This release follows a string of federal data exposures in October. In September, the hacking group ShinyHunters claimed to have stolen employee medical and job data from the Federal Bureau of Investigation. Last week, a class action lawsuit was filed regarding a breach that exposed data on millions of current and former military personnel.
Emma Best, a co-founder of Distributed Denial of Secrets, stated that the data was obtained by a group calling itself the Department of Peace. Best said a search tool developed by a hacktivist named "maia arson crimew" would allow the public to browse the records. She argued the tool would "replace anonymity with accountability" and aid congressional oversight.
The Department of Peace claimed in March that it hacked DHS to obtain vendor contract documents. In a statement accompanying the new leak, the group said DHS employees "have our information, so it’s only fair that we have theirs." They expressed hope that the data would help limit further harm by the department.
DHS did not immediately return a message seeking comment. The Department of Peace said the data was harvested from Okta, a sign-on service used by the department. Okta responded that its systems remained secure and showed no evidence of compromise.
Independent verification of the full dataset has been limited. Reporters matched personal information for about six employees to credit bureau records and dark web breach data. In other instances, phone numbers for three employees were confirmed via direct calls. One employee said it was the first they had heard of the breach. Some data points matched public LinkedIn profiles, while others revealed nonpublic details about internal organization charts and undisclosed programs.
