Hacker leaks data on thousands of US Homeland Security staff

What was taken

A hacker stole and published personally identifiable information (PII) about more than 40,000 employees of the US Department of Homeland Security (DHS), according to TechCrunch↗ (opens in a new tab). The leaked data includes names, job titles, work email addresses, mobile numbers, and office locations. More than half the records (about 21,000) are for US Customs and Border Protection (CBP) staff, with another 10,000 linked to Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) unit. Nearly 1,000 records are for staff at the Cybersecurity and Infrastructure Security Agency (CISA). The rest cover employees at DHS headquarters and other agencies, including US Citizenship and Immigration Services and the Federal Protective Service.

The dataset also contains information about employees' membership in internal user groups, which can reveal what systems and tools they have access to. This includes access to Microsoft 365, Adobe Acrobat, Citrix, and specialist tools like Penlink (a web surveillance platform), Mobile Fortify (a facial recognition app), and even online therapy services.

Who is affected

The breach affects a wide range of DHS personnel, including border and immigration agents, cybersecurity staff, and senior officials. The number of records exposed is about one-fifth of the DHS workforce, which totals around 220,000 people. The data was published online and shared with DDoSecrets, a nonprofit that hosts leaked datasets, after being provided to journalist and hacker maia arson crimew.

How the attack worked

It is not yet clear how the hacker gained access to the data. The breach reportedly took place around mid-August 2026, based on timestamps in the records. The hacker, using the alias "Department of Peace," left a note with the data but did not respond to questions from TechCrunch about the method used. There is no public information yet on whether the vulnerability has been fixed or if DHS is aware of the breach.

The response

DHS did not respond to TechCrunch's request for comment. Okta, a company named in the story, said its own systems were not compromised. Headspace, an online therapy provider mentioned in the user group data, said it has not provided services to DHS or ICE since 2023. Penlink, whose surveillance tools were referenced in the data, did not comment.

Has this happened before?

This is the second reported breach involving DHS this year, after the same hacker claimed to have stolen thousands of contracts between DHS and private sector vendors. It follows other recent attacks on US government agencies, including the theft of FBI personnel records and the personal data of millions of military service members from the Pentagon's HR unit.

What you should do

For affected staff, the exposure of work contact details and internal group memberships could increase the risk of targeted phishing or social engineering attacks. Security teams should monitor for suspicious activity and consider additional training for staff on how to spot and report phishing attempts. Anyone whose details are in the dataset should be alert to unsolicited contact and requests for sensitive information.