Breach leaks personnel records of more than 40,000 Homeland Security workers

A hacker operating under the name Department of Peace has released personal records belonging to more than 40,000 employees of the U.S. Department of Homeland Security, TechCrunch reported. The exposed information contains names, job titles, office locations, email addresses, and mobile phone numbers across multiple federal agencies. The records represent roughly one-fifth of the department's 220,000-person staff, including roughly 21,000 employees at Customs and Border Protection, around 10,000 workers at Immigration and Customs Enforcement, and nearly 1,000 staff members at cybersecurity agency CISA. [1][2]

The intruder claimed to have retrieved the data from an Okta single sign-on platform used across Homeland Security agencies, though an Okta spokesperson stated that its systems remain secure and showed no sign of compromise. In addition to contact details, the exfiltrated records detail which internal tools employees can use. This includes membership in user groups for everyday software like Microsoft 365, online therapy services, and specialized operational tools, such as the Mobile Fortify facial-recognition app used by hundreds of border personnel. [1][2]

The incident marks the second breach tied to Homeland Security this year by the same attacker, following earlier federal intrusions involving the Pentagon and thousands of FBI personnel. Copies of the stolen data were shared with transparency group DDoSecrets, with individual record timestamps suggesting the directory files were taken around mid-August. [1]