Hacktivist Group Posts Searchable Database of 41,000 DHS Staff Records

The Department of Peace, a hacktivist group, has published a searchable database of more than 41,000 Homeland Security employees and contractors. The records include people in undercover and surveillance roles, and the file went public on Wednesday, Oct. 28. The group says it pulled the data from a single sign-on service run by Okta that DHS uses. Okta says it has no evidence its own systems were compromised, which leaves the central question unanswered.

According to CNBC and The Washington Post, the group posted the records on the Distributed Denial of Secrets leak site. The Post reported that the identities of ICE, CBP and other DHS officers were posted online. Distributed Denial of Secrets is a nonprofit that publishes leaked material, and it received the data from the group, according to Nextgov/FCW.

What the leaked DHS database contains

Reuters reports that the data covers staff at ICE, CBP, Homeland Security Investigations, CISA and other DHS components. The headline figure varies by outlet, and no outlet has confirmed the exact count.

Counts in leaks like this often shift once duplicate and outdated entries are removed, so the final number may differ from the one circulating now.

Some entries describe surveillance, computer forensics and undercover roles, according to Nextgov/FCW. The group and reporters say those details could help someone identify or target sensitive personnel. Security researchers and officials warn that exposed assignment and contact data can help attackers pick targets and craft convincing impersonation attempts.

Did Okta's single sign-on service get breached?

The access route is the claim that turns a data dump into an identity security question. The group says the records came from an Okta single sign-on service that DHS uses. According to CNBC, Reuters and Tech Insider, that claim is the only source for the access route.

An Okta spokesperson told CNBC and Reuters: "Okta is secure, and we have no evidence our data or systems were compromised." That statement is narrow. It addresses Okta's own data and systems, not whether a DHS account, a DHS configuration or a DHS employee's login was abused.

The possibilities lead to very different fixes. A flaw inside Okta's platform would reach every customer that relies on it. A misconfigured DHS account would be a government IT problem. Stolen credentials would point to how individual accounts were protected, including whether multifactor authentication was enforced. Reporters have not yet established which of these, if any, applies.

How much of the database checks out

Reuters could not immediately verify the full data set. It did match six named employees to credit bureau and breach records, and one of them said it was the first they had heard of a breach. Six matches in a file of more than 40,000 entries is a small sample. It shows that some records tie to real people, not that the whole file is accurate.

Reporters have not established how many entries are fake, outdated or duplicated. Until that is known, employees should treat their own records as possibly exposed and should not assume a missing name means safety.

The group previously claimed a DHS hack in March that involved contractor records, according to Nextgov/FCW. Reporting says little verified information exists about who the group is, so it is unclear whether the March claim and this leak are connected.

How this compares with earlier government leaks

The closest precedent is a January 2026 leak that reportedly exposed about 4,500 DHS and ICE employees' details. Wikipedia's entry on the incident says that leak was hosted in the Netherlands, outside US jurisdiction. That placement limits direct American legal action, and the hosting location of this file has not been established in the reporting so far.

Reuters called this the third major government data leak to make headlines in the past month. That pace suggests leak groups now see public-sector staff records as a steady supply rather than a one-off target.

What DHS has said, and what it has not

DHS told CBC it was "aware of a potential breach and is actively working to address the situation swiftly and effectively." The department promised updates when more information is available. It has not yet confirmed the scope of the exposure, described its findings or said whether it will notify affected employees.

That last gap matters most. Employees named in the file cannot protect themselves against risks they have not been told about.

The group frames the leak as a response to DHS Secretary Markwayne Mullin's pledge to intensify immigration enforcement, according to Nextgov/FCW. Its statement argues that DHS employees "have our information, so it's only fair that we have theirs." That is a retaliation argument, and it does nothing to reduce the risk to the people in the file.

Lawmakers have dealt with this type of threat before. A bill against doxxing of law enforcement officials was introduced earlier, according to Wikipedia's account, but no confirmed link to this leak has been reported.

What to do if you work for DHS or use Okta

Most readers need to take no action. Federal staff and contractors whose names or assignments may appear in the file have more concrete steps to consider:

• Contact your agency security team and ask whether your records appear in the database.
• Reset passwords for work accounts and for any personal account that reuses a work password, and confirm multifactor authentication is turned on.
• Treat unexpected calls, texts and emails as suspect, even when they cite your correct title, office or case. Verify requests through a number you already have.
• Limit public posts about your assignment, and check which contact details appear in public profiles and records.
• Review your credit reports, since Reuters matched named employees to credit bureau records.

Organizations that use Okta should check their own sign-in logs for unusual activity, even though Okta says it has found no compromise. A vendor statement does not rule out misuse of your own accounts.

What to watch next

Four developments will show whether this is a single breach or a pattern. The first is whether DHS confirms the scope, reports what its investigation found and notifies affected staff. The second is whether Okta or an independent forensic team finds evidence that supports or rules out the access route.

The third is whether independent reporting can verify how many records are authentic. The fourth is whether the March claim and this leak trace back to the same actors.

Exposures of public-sector data keep surfacing from very different systems. USA 24 recently reported that an open CitySourced database exposed 42 million documents and resident data. Federal technology decisions can also move quickly, and DHS has ordered civilian agencies to drop Acronis products within 180 days.

The next official update from DHS will say more than any single headline. Until then, a group makes claims that remain unverified, Okta denies a compromise on its side, and the government has not said what it found.