DHS leak: hacktivists publish work details of 41,000 US security staff

A searchable database said to hold work details of more than 41,000 people employed by the United States Department of Homeland Security (DHS) was published online on Wednesday, October 28, 2026. The records cover staff of Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP) and other DHS agencies. A group calling itself the "Department of Peace" says it took the data, and the transparency collective Distributed Denial of Secrets (DDoSecrets) published it. DHS said it is aware of a potential breach and is working to address it.

The leak shows how much damage can follow when one sign-in system is breached. Single sign-on, often shortened to SSO, lets an employee log in once and then reach many internal apps without signing in again. It is convenient and, when well run, safer than dozens of separate passwords. But it also concentrates risk: if attackers take control of the SSO account or the system behind it, they may be able to reach directory data across a whole organisation. The hackers' claim that they used a DHS SSO service run by Okta has not been confirmed by DHS or Okta, so it should be treated as the group's account for now.

The leak is also a sharp example of "hacktivism", meaning hacking done for a political cause rather than for money. The group says it targeted people involved in immigration policy and operations, at a time of fierce political argument in the United States over deportations. Reports say the database includes undercover investigators, which raises safety questions for those officers and their families. Publishing the names and contact details of law-enforcement staff can expose them to harassment, and it can also put ongoing investigations at risk.

DHS has had serious data incidents before. In 2018 it said personal details of more than 240,000 current and former employees had been exposed after a former staff member made an unauthorised copy of an internal database. The new leak again shows that government directories, which list who works where and how to reach them, are valuable targets, because they help attackers plan convincing phishing messages, which are fake emails or calls that trick people into handing over passwords.

For Indian organisations, the lesson travels well. Indian ministries, banks and large companies increasingly use SSO and cloud identity services. India's Computer Emergency Response Team (CERT-In) requires many organisations to report cyber incidents quickly, and the Digital Personal Data Protection Act makes protecting personal data a legal duty. A breach of an identity system is not only an IT problem; it can also become a legal and safety problem.

Short-term: DHS will be investigating how the data was taken and whether the claimed SSO route is real. Staff whose details were exposed may face a wave of phishing emails, scam calls and unwanted contact, and may need new phone numbers or added protection.

Long-term: Expect more scrutiny of how government agencies secure identity systems, including stronger multi-factor authentication, meaning a second check such as a hardware key or app approval on top of a password. The incident may also feed calls in the United States for tougher laws on publishing law-enforcement officers' personal details.

Who is affected: More than 41,000 DHS employees, especially ICE and CBP officers and undercover investigators; DHS itself; and any organisation that relies on a single sign-on service for staff access.

Questions and Answers