An attacker publishes data on more than 40,000 US Homeland Security staff

What happened

• Personal data on more than 40,000 people who work at the US Department of Homeland Security was published online, TechCrunch reported on October 28, 2026.
• The material comes from a breach earlier this year that the department had not disclosed. It includes names, job titles and work contact details, such as email addresses, mobile numbers and office locations.
• An attacker who goes by Department of Peace claims the data came from the Okta single sign-on system the department uses so employees and contractors across its units can log in to the central network.
• According to TechCrunch, that system also holds login records and details of which systems and internal apps each account can use.

Why it matters

• More than half of the set, about 21,000 records, belongs to Customs and Border Protection (CBP) staff, who work at airports and ports of entry.
• Another 10,000 records belong to staff at Immigration and Customs Enforcement (ICE) and its investigations unit, HSI. Just under 1,000 belong to CISA, the federal cyber defense office.
• Exposing immigration officers carries a different risk from a corporate leak: it opens the door to personal harassment and targeted impersonation of people in enforcement roles.
• If the attacker got into the Okta system, the problem goes beyond a contact list: a map of who can enter which system is useful for planning later attacks.

The number

More than 40,000 people. That is the size of the published record, which spans from border officers to senior department officials.

Context

The attacker left a note with the data that TechCrunch was able to see: «They have our information, so it’s only fair that we have theirs». The attacker did not respond to the outlet’s questions about how the breach was carried out.

The set also includes thousands of records from the department’s headquarters and other units, such as Citizenship and Immigration Services and the Federal Protective Service.

A single sign-on system concentrates the access of thousands of people in one point: if it falls, the attacker gets a broad view of the organization.

What’s next

• The department has yet to confirm the scope of the breach and how it happened.
• It remains to be seen whether Okta confirms access to its platform or whether the problem lay in the department’s configuration.

Bottom line

The same department banned DeepSeek across US civilian bodies. Data breaches keep recurring: Quest Diagnostics confirmed access to patient records and ransomware operators exploit a GlobalProtect flaw that bypasses MFA. In digital trust, browsers blocked eight eMudhra certificates with guessable keys.

Sources

• TechCrunch — Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents (October 28, 2026). TechCrunch reviewed the published data; no statement from the department was found.
• Cover image: CBP Photography, public domain, via Wikimedia Commons

Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.