Massive Previously Undisclosed DHS Data Breach Exposes 40,000+ Staff PII and Internal Surveillance Tool Access Details

---

The personally identifiable information (PII) of thousands of U.S. Department of Homeland Security (DHS) personnel has been posted publicly online, following an unreported breach that siphoned off massive volumes of internal government data earlier this year.

The leaked dataset covers more than 40,000 current federal DHS employees across nearly all agency divisions, including frontline border patrol and immigration officers, internal cybersecurity teams, and senior agency leadership. Exposed records include full legal names, official job titles, and complete work contact details: government-issued email addresses, work-issued cell phone numbers, and physical office location assignments for every listed staff member.

The threat actor operating under the alias Department of Peace claims they exfiltrated the full dataset directly from DHS’s Okta single sign-on (SSO) platform, the unified system the agency uses to grant consistent network access to all employees and cross-agency contractors. The Okta repository also houses full IT access logs and granular user account permission records, including documentation of every internal system and proprietary agency application each staff member is authorized to use.

Roughly half the leaked records (totaling 21,000 entries) belong to personnel at U.S. Customs and Border Protection (CBP), the agency that manages operations at airports and all cross-border ports of entry. Another 10,000 records are tied to staff at Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) division, while nearly 1,000 entries belong to employees at the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The remaining thousands of records cover DHS headquarters staff and personnel from smaller sub-agencies including U.S. Citizenship and Immigration Services (USCIS) and the Federal Protective Service.

In a public note posted alongside the leaked dataset (seen and verified by TechCrunch), the Department of Peace hacker wrote, “They have our information, so it’s only fair that we have theirs.” The threat actor did not respond to follow-up emails from TechCrunch requesting details on the breach methodology or additional comment.

This incident is the latest in a string of high-profile U.S. government data thefts in recent months, following prior breaches that exposed personnel records for thousands of FBI agents, plus the personal identifiable data of millions of active and retired U.S. military service members stolen from Pentagon human resources systems. It also marks the second public DHS breach of the year: the same Department of Peace actor previously claimed responsibility for a separate leak of thousands of contracts between DHS and private sector partners, including defense contractors and commercial surveillance technology vendors.

The newly leaked dataset, which independent verification has confirmed is almost entirely legitimate, provides a rare (if incomplete) window into the operational scale and internal workflows of DHS — an agency whose high-profile policies including mass deportations, prolonged arbitrary detentions, and documented cases of deadly force used against U.S. citizens emerged as a major voting issue in the lead-up to the U.S. midterm elections. The stolen DHS data was first shared with independent journalist and cybersecurity researcher maia arson crimew, who then provided a full copy to DDoSecrets, a non-profit collective that hosts public interest leaked datasets for research and transparency purposes.

TechCrunch confirmed the authenticity of a large sample of the records by cross-referencing names of publicly documented DHS employees against the offline full copy of the database. Timestamps embedded in every individual employee record indicate the full staff directory was exfiltrated in mid-August. The 40,000+ leaked records make up roughly one-fifth of DHS’s total 220,000-person global workforce. As of initial reporting, it remained unconfirmed whether the security vulnerability that allowed the breach to occur has been patched, or if DHS leadership was even aware the data theft had taken place before the leak became public.

Following TechCrunch’s initial publication of the story, a DHS spokesperson issued an official response: “DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.” When contacted for comment, Okta representatives confirmed they were aware of the media report, stating: “Okta is secure, and we have no evidence our data or systems were compromised.”

Leaked Data Uncovers Surveillance and Third-Party Tool Access

Beyond exposing sensitive PII for thousands of DHS frontline staff, the dataset also reveals previously unreported details about the full suite of surveillance and productivity tools DHS personnel are authorized to access — a detail that has long been a point of advocacy from critics calling for investigations into tech firms that sell or fund surveillance technology for ICE operations.

The records map staff membership across dozens of internal Active Directory user groups, the system that administers access to DHS internal tools, shared services, and all third-party commercial platforms licensed for agency use. The vast majority of employees in the dataset are listed as members of the default access group for Microsoft 365, the cloud platform that hosts all DHS internal emails and shared files, alongside standard user groups for common desktop software including Adobe Acrobat and Citrix.

The data also shows roughly 4,500 users, including ICE field agents and deportation officers, are members of an access group labeled Headspace_users. The mental health platform Headspace previously held an $82,500 federal contract with ICE that expired in 2023, which was intended to provide dedicated mental health software for staff in ICE’s Enforcement and Removal Operations (ERO) deportation division. A Headspace spokesperson confirmed that the company has not provided any services to DHS or ICE at all since that 2023 contract concluded.

Dozens of other Active Directory user groups are tied to Penlink, a commercial web surveillance firm that sells technology the company claims can geolocate hundreds of millions of mobile devices globally. Penlink has held ongoing contract agreements with ICE for multiple years. These Penlink access groups range in size from small teams of 5 to 10 staff at local DHS field offices across the U.S. to groups of more than 2,000 personnel within ICE’s national HSI division. One specific group is tied to access for Penlink PLX, a tool the company markets as a platform to capture and analyze real-time intelligence pulled directly from phone calls, SMS messages, web browsing activity, and public social media posts. A Penlink spokesperson did not respond to repeated requests for comment.

More than 200 CBP employees are also listed as part of a dedicated access group for Mobile Fortify, a facial recognition application used by both CBP and ICE officers to identify individuals and verify personal information and immigration status. Additional smaller user groups cover authorized access to ChatGPT, with membership including several senior DHS leadership officials, plus dedicated access groups for staff assigned to investigate China-linked state-sponsored hacking groups widely known as Salt Typhoon and Volt Typhoon.

Transparency Advocates Frame Leak As Critical Research Resource

Open records researchers and government transparency advocates note that the newly exposed dataset will provide critical leads for ongoing investigations into documented alleged abuses during the Trump administration, including the list of exposed official staff emails that can be used to submit targeted, specific Freedom of Information Act (FOIA) public records requests.

“Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets actionable results,” explained Ryan Shapiro, executive director of government transparency non-profit Property of the People. “Given the Trump administration’s contempt for even basic baseline transparency, the need for these tools is extremely urgent.”

DDoSecrets co-founder and independent journalist Emma Best added that the leaked DHS dataset will act as a major “catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests.”

This report was later updated to include on-the-record comment from DHS leadership.