There you have it! The leak site Distributed Denial of Secrets (DDoSecrets) published an archive …
October 29, 2026 · 0 likes · 0 comments
Cybersecurity Workforce
There you have it! The leak site Distributed Denial of Secrets (DDoSecrets) published an archive on Oct. 28 with records on more than 40,000 DHS employees and contractors, including names, job titles, work emails, phone numbers and office locations.
What the reporting says:
CBP accounts for about 21,000 records. ICE has roughly 10,000. USCIS about 6,200, CISA just under 1,000. That is roughly a fifth of a department of about 220,000 people.
Job titles and email groups reportedly show who works in special operations, surveillance, forensics and undercover assignments. The archive also lists Active Directory group memberships, the groups that govern access to internal tools.
A hacker group calling itself Department of Peace says it pulled the data from the Okta single sign-on system DHS uses. Okta denies it: "Okta is secure, and we have no evidence our data or systems were compromised." Nobody has shown Okta was the point of entry.
Reuters matched details for several employees against other records and confirmed phone numbers by calling three of them. TechCrunch verified a portion as well.
DDoSecrets co-founder Emma Best says a search tool built on the data would "replace anonymity with accountability." DHS officials say threats against employees have multiplied as enforcement intensified. DHS did not respond to requests for comment from Reuters, WIRED or TechCrunch, and has not said whether it confirmed the breach or fixed the hole.
This is the third major federal data loss in about a month, after the FBI employee data claim in September and the Defense Department breach now facing a class action.
Speaking as someone who has spent years on government cybersecurity:
I think the safety of public servants is not a partisan issue. Whatever you believe about immigration policy, publishing phone numbers of people in undercover and surveillance roles puts lives and operations at risk.
I also think agencies holding this data have to treat their identity systems like a weapon system. An identity provider is the front door to everything. If the attackers' account is right, one door gave up a fifth of a department.
The records were last updated Aug. 19, more than two months before publication, and the breach had not been publicly disclosed before the archive went up. The public learned about it from the leakers, not from DHS. How is that acceptable?
Zero trust, least privilege, continuous monitoring of who touches directory data. We have been saying it for a decade. Time to execute.
Full story, just the facts: https://lnkd.in/e72JwpGS
What the reporting says:
CBP accounts for about 21,000 records. ICE has roughly 10,000. USCIS about 6,200, CISA just under 1,000. That is roughly a fifth of a department of about 220,000 people.
Job titles and email groups reportedly show who works in special operations, surveillance, forensics and undercover assignments. The archive also lists Active Directory group memberships, the groups that govern access to internal tools.
A hacker group calling itself Department of Peace says it pulled the data from the Okta single sign-on system DHS uses. Okta denies it: "Okta is secure, and we have no evidence our data or systems were compromised." Nobody has shown Okta was the point of entry.
Reuters matched details for several employees against other records and confirmed phone numbers by calling three of them. TechCrunch verified a portion as well.
DDoSecrets co-founder Emma Best says a search tool built on the data would "replace anonymity with accountability." DHS officials say threats against employees have multiplied as enforcement intensified. DHS did not respond to requests for comment from Reuters, WIRED or TechCrunch, and has not said whether it confirmed the breach or fixed the hole.
This is the third major federal data loss in about a month, after the FBI employee data claim in September and the Defense Department breach now facing a class action.
Speaking as someone who has spent years on government cybersecurity:
I think the safety of public servants is not a partisan issue. Whatever you believe about immigration policy, publishing phone numbers of people in undercover and surveillance roles puts lives and operations at risk.
I also think agencies holding this data have to treat their identity systems like a weapon system. An identity provider is the front door to everything. If the attackers' account is right, one door gave up a fifth of a department.
The records were last updated Aug. 19, more than two months before publication, and the breach had not been publicly disclosed before the archive went up. The public learned about it from the leakers, not from DHS. How is that acceptable?
Zero trust, least privilege, continuous monitoring of who touches directory data. We have been saying it for a decade. Time to execute.
Full story, just the facts: https://lnkd.in/e72JwpGS