Phishing · Identity · Threat Intelligence · Incident Response
Hackers publish data on 41,000 US Homeland Security workers
A hacker group has published work contact details and internal group memberships for over 41,000 US Department of Homeland Security employees, raising risks of targeted scams and harassment.
Ross GrantUpdated 3 min read
The short version
Hackers have published work contact details and internal group memberships for over 41,000 people who work at the US Department of Homeland Security. This could make it easier for criminals to target these workers with scams or harassment. The department has warned staff to be careful about unexpected messages or calls. Only one security outlet has reported this so far, and not all details are confirmed.
By the numbers
- 41,000+DHS employees with data publishedMalwarebytes
- 6,600ICE employees included in the breachMalwarebytes
- 21,000+CBP employees included in the breachMalwarebytes
- 7,000DHS offices affectedMalwarebytes
What happened?
A hacker group claims to have stolen and published data on over 41,000 US Department of Homeland Security workers. The leaked files include work contact details and internal group memberships. DHS says it is aware of a potential breach, but has not confirmed all details. Only one outlet has reported the incident so far.
Who is affected
A hacker group calling itself the Department of Peace has published data on more than 41,000 people working for the US Department of Homeland Security (DHS). The leaked records cover staff at nearly 7,000 offices. This includes almost 6,600 Immigration and Customs Enforcement (ICE) employees, over 21,000 Customs and Border Protection (CBP) staff, and people working at the Cybersecurity and Infrastructure Security Agency (CISA) [Malwarebytes (opens in a new tab)].
What was taken
The published files include names, work email addresses, phone numbers, office addresses, job titles, and internal group memberships. Some groups listed in the data give access to sensitive tools, such as the facial recognition system Mobile Fortify and Penlink, a service that can track mobile device locations. The data also reveals which agents are assigned to sensitive roles like special operations and undercover work, according to The Guardian (as cited by Malwarebytes).
The leak did not include Social Security numbers, home addresses, or medical records, unlike a recent FBI breach. However, even basic work details can be cross-referenced with other public or leaked data to identify individuals and put them at risk.
How the attack worked
The Department of Peace claims it accessed the information through a single sign-on (SSO) service provided by identity company Okta. SSO allows users to log in once to access multiple workplace services. Okta says it has no evidence its own systems were breached, but it is possible that attackers used stolen credentials from a DHS account to get in. Timestamps on the records suggest the data was taken around mid-August 2026. The group says the attack was in response to a July statement by the DHS Secretary about increasing enforcement.
The response
DHS has said it is aware of a potential breach. One employee told Reuters they had not been notified. DHS has warned staff about the risk of scams, harassment, and physical threats, and has advised employees to follow agency security guidance, verify unexpected contact, and report threats. There is no confirmation yet of any specific threats or operational impact resulting from the leak.
What you should do
DHS employees are urged to:
- Treat unexpected calls, emails, or texts about their role or colleagues with caution.
- Verify any unusual contact using trusted methods.
- Never share passwords or multi-factor authentication (MFA) codes.
- Change any personal passwords reused for work and enable MFA where possible.
- Report suspicious contact or threats to their security team, and contact law enforcement if in immediate danger.
So far, only Malwarebytes has reported this breach. DHS has not confirmed all details, and it is unclear if any operations have been affected or if any specific threats have resulted from the leak.
Claimed vs confirmed
- Unconfirmed
Hackers accessed DHS data via Okta single sign-on.
The Department of Peace claims to have used Okta SSO, but Okta says its own systems were not breached.
- Confirmed
The breach was a response to a DHS Secretary statement in July.
The hacker group stated this as their motive, and the timeline matches their claim.
Why it matters
Publishing work details and group memberships for thousands of government employees increases the risk of targeted phishing, scams, and harassment. Even basic work information can be used to identify individuals or plan attacks. The breach highlights the risks of single sign-on systems and the importance of strong credential security.
Key points
- Data on 41,000 DHS workers was published by hackers.
- Leaked details include work emails, phone numbers, and internal group memberships.
- Attackers claim to have used single sign-on (SSO) to access the data.
- DHS warns staff about scams, harassment, and physical threats.
- Only one outlet has reported the breach, and not all details are confirmed.
Sources
Malwarebytes
Reference
