# Hacktivist Group Posts Searchable Database of 41,000 DHS Staff Records

- URL: https://usa-24.com/dhs-data-breach-41000-employees/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-11-01T14:37:05.972Z
- Updated: 2026-11-01T14:37:05.978Z
- Topics: Data Breach, Homeland Security, Okta, Hacktivism, Government Security

> A hacktivist group calling itself the Department of Peace says it pulled 41,000 Homeland Security staff and contractor records from an Okta login service. DHS says it is aware of a potential breach.

## Key takeaways

- A hacktivist group calling itself the Department of Peace published a searchable database of more than 41,000 DHS personnel and contractors on Wednesday, Oct. 28.
- The group says the records came through a DHS single sign-on service run by Okta, but Okta says it has no evidence its own data or systems were compromised.
- Reuters matched six named employees to credit bureau and breach records but could not immediately verify the full data set.
- Some entries describe surveillance, computer forensics and undercover roles, which reporters say could help someone target sensitive personnel.
- DHS says it is aware of a potential breach and is working to address it, but it has not yet confirmed the scope of the exposure.

The Department of Peace, a hacktivist group, has published a searchable database of more than 41,000 Homeland Security employees and contractors. The records include people in undercover and surveillance roles, and the file went public on Wednesday, Oct. 28. The group says it pulled the data from a single sign-on service run by Okta that DHS uses. Okta says it has no evidence its own systems were compromised, which leaves the central question unanswered.

According to [CNBC](https://www.cnbc.com/2026/10/29/dhs-data-breach-ice-cdp-deportations.html) and [The Washington Post](https://www.washingtonpost.com/immigration/2026/10/28/ice-cbp-other-dhs-officer-identities-posted-online-data-breach/), the group posted the records on the Distributed Denial of Secrets leak site. The Post reported that the identities of ICE, CBP and other DHS officers were posted online. Distributed Denial of Secrets is a nonprofit that publishes leaked material, and it received the data from the group, according to [Nextgov/FCW](https://www.nextgov.com/cybersecurity/2026/10/dhs-personnel-leak-exposes-contact-details-and-sensitive-job-information/416901/).

## What the leaked DHS database contains

[Reuters](https://www.usnews.com/news/top-news/articles/2026-10-28/leak-website-releases-data-on-tens-of-thousands-of-dhs-employees) reports that the data covers staff at ICE, CBP, Homeland Security Investigations, CISA and other DHS components. The headline figure varies by outlet, and no outlet has confirmed the exact count.

| Outlet | Figure reported |
|---|---|
| CNBC | More than 41,000 personnel and contractors |
| The Washington Post | More than 41,000 personnel and contractors |
| Reuters | More than 40,000 employees |
| CBC | More than 40,000 employees |

Counts in leaks like this often shift once duplicate and outdated entries are removed, so the final number may differ from the one circulating now.

Some entries describe surveillance, computer forensics and undercover roles, according to Nextgov/FCW. The group and reporters say those details could help someone identify or target sensitive personnel. Security researchers and officials warn that exposed assignment and contact data can help attackers pick targets and craft convincing impersonation attempts.

## Did Okta's single sign-on service get breached?

The access route is the claim that turns a data dump into an identity security question. The group says the records came from an Okta single sign-on service that DHS uses. According to [CNBC](https://www.cnbc.com/2026/10/29/dhs-data-breach-ice-cdp-deportations.html), [Reuters](https://www.usnews.com/news/top-news/articles/2026-10-28/leak-website-releases-data-on-tens-of-thousands-of-dhs-employees) and [Tech Insider](https://tech-insider.org/dhs-okta-data-leak-41000-staff-department-of-peace-2026/), that claim is the only source for the access route.

An Okta spokesperson told CNBC and Reuters: "Okta is secure, and we have no evidence our data or systems were compromised." That statement is narrow. It addresses Okta's own data and systems, not whether a DHS account, a DHS configuration or a DHS employee's login was abused.

The possibilities lead to very different fixes. A flaw inside Okta's platform would reach every customer that relies on it. A misconfigured DHS account would be a government IT problem. Stolen credentials would point to how individual accounts were protected, including whether multifactor authentication was enforced. Reporters have not yet established which of these, if any, applies.

## How much of the database checks out

Reuters could not immediately verify the full data set. It did match six named employees to credit bureau and breach records, and one of them said it was the first they had heard of a breach. Six matches in a file of more than 40,000 entries is a small sample. It shows that some records tie to real people, not that the whole file is accurate.

Reporters have not established how many entries are fake, outdated or duplicated. Until that is known, employees should treat their own records as possibly exposed and should not assume a missing name means safety.

The group previously claimed a DHS hack in March that involved contractor records, according to Nextgov/FCW. Reporting says little verified information exists about who the group is, so it is unclear whether the March claim and this leak are connected.

## How this compares with earlier government leaks

The closest precedent is a January 2026 leak that reportedly exposed about 4,500 DHS and ICE employees' details. [Wikipedia's entry on the incident](https://en.wikipedia.org/wiki/Department_of_Homeland_Security_employee_data_leak) says that leak was hosted in the Netherlands, outside US jurisdiction. That placement limits direct American legal action, and the hosting location of this file has not been established in the reporting so far.

[Reuters](https://www.usnews.com/news/top-news/articles/2026-10-28/leak-website-releases-data-on-tens-of-thousands-of-dhs-employees) called this the third major government data leak to make headlines in the past month. That pace suggests leak groups now see public-sector staff records as a steady supply rather than a one-off target.

## What DHS has said, and what it has not

DHS told [CBC](https://www.cbc.ca/news/world/dhs-data-breach-leak-distributed-denial-of-secrets-9.7400488) it was "aware of a potential breach and is actively working to address the situation swiftly and effectively." The department promised updates when more information is available. It has not yet confirmed the scope of the exposure, described its findings or said whether it will notify affected employees.

That last gap matters most. Employees named in the file cannot protect themselves against risks they have not been told about.

The group frames the leak as a response to DHS Secretary Markwayne Mullin's pledge to intensify immigration enforcement, according to Nextgov/FCW. Its statement argues that DHS employees "have our information, so it's only fair that we have theirs." That is a retaliation argument, and it does nothing to reduce the risk to the people in the file.

Lawmakers have dealt with this type of threat before. A bill against doxxing of law enforcement officials was introduced earlier, according to Wikipedia's account, but no confirmed link to this leak has been reported.

## What to do if you work for DHS or use Okta

Most readers need to take no action. Federal staff and contractors whose names or assignments may appear in the file have more concrete steps to consider:

- Contact your agency security team and ask whether your records appear in the database.
- Reset passwords for work accounts and for any personal account that reuses a work password, and confirm multifactor authentication is turned on.
- Treat unexpected calls, texts and emails as suspect, even when they cite your correct title, office or case. Verify requests through a number you already have.
- Limit public posts about your assignment, and check which contact details appear in public profiles and records.
- Review your credit reports, since Reuters matched named employees to credit bureau records.

Organizations that use Okta should check their own sign-in logs for unusual activity, even though Okta says it has found no compromise. A vendor statement does not rule out misuse of your own accounts.

## What to watch next

Four developments will show whether this is a single breach or a pattern. The first is whether DHS confirms the scope, reports what its investigation found and notifies affected staff. The second is whether Okta or an independent forensic team finds evidence that supports or rules out the access route.

The third is whether independent reporting can verify how many records are authentic. The fourth is whether the March claim and this leak trace back to the same actors.

Exposures of public-sector data keep surfacing from very different systems. USA 24 recently reported that an open [CitySourced database exposed 42 million documents and resident data](https://usa-24.com/citysourced-data-breach-42-million-documents/). Federal technology decisions can also move quickly, and DHS has ordered civilian agencies to [drop Acronis products within 180 days](https://usa-24.com/acronis-federal-ban-dhs-order/).

The next official update from DHS will say more than any single headline. Until then, a group makes claims that remain unverified, Okta denies a compromise on its side, and the government has not said what it found.

## Frequently asked questions

### Is my DHS or ICE information in the leaked database?

The database is posted on the Distributed Denial of Secrets leak site, and reporters have not established how many entries are real. Current and former DHS, ICE, CBP and CISA staff should assume their details could be exposed. Ask your agency security team directly whether your records appear in the file.

### Did Okta get breached in this DHS leak?

Okta says it has no evidence that its own data or systems were compromised. The group claims the records came through an Okta single sign-on service that DHS uses, but that claim is the only source for the access route. Possible explanations include a breach, a misconfiguration or abuse of stolen credentials, and none has been confirmed.

### Who is the Department of Peace?

Reporting says little verified information exists about the group. It previously claimed a DHS hack in March that involved contractor records, but it is not yet known whether that claim and this leak are connected. The group says the leak responds to DHS Secretary Markwayne Mullin's pledge to intensify immigration enforcement.

### What should federal employees do after a leak like this?

Contact your agency security team, reset passwords and confirm that multifactor authentication is active. Treat unexpected messages as suspect even when they cite your correct job details, and verify requests through a number you already have. Watch for impersonation attempts, since exposed assignment data can make phishing look accurate.

## Sources

1. [Over 41,000 U.S. Homeland Security officials' details apparently exposed after massive data breach — CNBC](https://www.cnbc.com/2026/10/29/dhs-data-breach-ice-cdp-deportations.html)
2. [ICE, CBP and other DHS officer identities posted online in data breach — The Washington Post](https://www.washingtonpost.com/immigration/2026/10/28/ice-cbp-other-dhs-officer-identities-posted-online-data-breach/)
3. [DHS personnel leak exposes contact details and sensitive job information — Nextgov/FCW](https://www.nextgov.com/cybersecurity/2026/10/dhs-personnel-leak-exposes-contact-details-and-sensitive-job-information/416901/)
4. [Leak Website Releases Data on Thousands of US Homeland Security Employees — Reuters via U.S. News](https://www.usnews.com/news/top-news/articles/2026-10-28/leak-website-releases-data-on-tens-of-thousands-of-dhs-employees)
5. [Personal data of 40,000 U.S. Homeland Security employees leaked in security breach — CBC](https://www.cbc.ca/news/world/dhs-data-breach-leak-distributed-denial-of-secrets-9.7400488)
6. [Hackers Cite Okta in 41,000-Staff DHS Leak — Tech Insider](https://tech-insider.org/dhs-okta-data-leak-41000-staff-department-of-peace-2026/)
7. [Department of Homeland Security employee data leak — Wikipedia](https://en.wikipedia.org/wiki/Department_of_Homeland_Security_employee_data_leak)