Key takeaways
- Over 40,000 Department of Homeland Security employee records including contact information and system access permissions were leaked after a breach at the agency's Okta single sign-on platform.
- The stolen data reveals access to surveillance tools including Penlink location tracking technology and Mobile Fortify facial recognition, raising questions about surveillance capabilities available to immigration enforcement agencies.
- The breach represents the second DHS data theft this year and follows major federal breaches affecting the FBI and Pentagon, indicating ongoing cybersecurity vulnerabilities across U.S. government.
- Transparency researchers said the exposed contact information will enable Freedom of Information Act requests and investigations into federal agency activities.
A hacker claiming the online handle Department of Peace has published personnel records for more than 40,000 employees of the U.S. Department of Homeland Security following a data theft earlier this year. The stolen data includes names, job titles, work email addresses, mobile phone numbers, and office locations of border agents, immigration officers, cybersecurity personnel, and senior department officials. The breach joins a series of federal data thefts that have compromised government agencies throughout 2024.
Scale and Scope of the Breach
The 40,000 exposed records represent approximately one-fifth of the Department of Homeland Security’s roughly 220,000-person workforce. According to TechCrunch, which verified some of the exposed data by matching names of known DHS employees against the leaked database, the records appear to have been exfiltrated around mid-August based on timestamps associated with each record.
Customs and Border Protection
More than 21,000 of the leaked records involve employees of U.S. Customs and Border Protection, the agency operating airports and border crossing checkpoints.
Immigration Enforcement
Approximately 10,000 records belong to Immigration and Customs Enforcement and its Homeland Security Investigations unit. Fewer than 1,000 records involve employees of CISA, the federal cybersecurity defense agency. Additional thousands relate to staff at DHS headquarters, U.S. Citizenship and Immigration Services, and the Federal Protective Service.
How the Data Was Accessed
The Okta Single Sign-On System
The hacker obtained the data from an Okta single sign-on platform used by DHS to manage authentication across its various agencies. Single sign-on systems serve as central gateways that allow employees to access multiple applications and databases through a single login credential.
The stolen data extends beyond contact information to include IT records and login permissions associated with each employee’s user account. These records reveal which internal systems and applications personnel are authorized to access within the department’s Active Directory system, which manages access to departmental tools, services, and third-party software.
Okta’s Response
Okta has denied that its systems were compromised. A company spokesperson stated: “Okta is secure, and we have no evidence our data or systems were compromised.” The exact method by which the hacker accessed the data remains undisclosed.
Surveillance Technologies and Tool Access
Corporate Software and Services
The leaked dataset shows that most DHS employees included in the breach had access to Microsoft 365, the cloud service hosting the agency’s email and file systems. User groups also reflected access to Adobe Acrobat, Citrix, and other standard office applications.
Mental Health Software
A user group designated “Headspace_users” contained approximately 4,500 members, primarily ICE agents and deportation officers. Headspace, a digital therapy platform, had previously held a federal contract with ICE valued at $82,500 that concluded in 2023 for what the agency described as “mental health software required for ERO employees,” referring to ICE’s Enforcement and Removal Operations division. A Headspace representative confirmed the company has provided no services to DHS or ICE since 2023.
Location Tracking Technologies
Multiple user groups reference Penlink, a web surveillance company offering technology that tracks mobile device location data across hundreds of millions of phones. The company describes its Penlink PLX product as capturing “real-time intelligence” from phone calls, text messages, web activity, and social media. Penlink has maintained ongoing contracts with ICE, with affected user group sizes ranging from a handful of local DHS office staff to more than 2,000 users nationally within ICE’s HSI operations. A Penlink representative did not respond to a request for comment.
Facial Recognition Systems
A separate user group included over 200 CBP agents associated with Mobile Fortify, a facial recognition application that CBP and ICE use to identify individuals and verify immigration status. Senior DHS officials also appear in groups with authorized ChatGPT access.
Recent Government Data Breaches
The DHS breach follows multiple other federal agency data thefts. Thousands of FBI agent personnel records were stolen in a separate breach, as were personal details of millions of serving and former military service members from Pentagon human resources systems. This constitutes the second DHS breach this year, after the same hacker previously claimed responsibility for stealing thousands of contracts between the department and private sector vendors including defense and surveillance technology companies.
Implications for Federal Transparency and Oversight
The exposed contact information holds value for researchers investigating government accountability and oversight. Ryan Shapiro, executive director at transparency nonprofit Property of the People, emphasized that email addresses and phone numbers function as “indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results.”
The hacker provided the data to journalist and cybersecurity researcher maia arson crimew, who then shared it with DDoSecrets, a nonprofit organization that publishes leaked datasets to serve the public interest. Emma Best, co-founder of DDoSecrets, stated that the exposed DHS data will become a “catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests.”
Outstanding Questions and Response
Whether the vulnerability enabling the initial breach has been remediated remains unclear. The Department of Homeland Security has not publicly confirmed knowledge of the data theft or detailed any remediation steps. A DHS spokesperson did not respond to TechCrunch’s request for comment regarding the breach. The timing of the exfiltration, occurring around mid-August, also raises questions about how long the compromise went undetected before becoming public.
Source: TechCrunch
Frequently Asked Questions
How many Department of Homeland Security employees were affected?
More than 40,000 DHS employees had their records exposed, representing approximately one-fifth of the agency's 220,000-person workforce. The majority were customs and border protection agents, with additional records from immigration enforcement, cybersecurity, and other department personnel.
What information was included in the leaked data?
The leaked data includes employee names, job titles, work email addresses, cell phone numbers, office locations, and information about which internal systems and applications employees are authorized to access. The data was stolen from Okta, the single sign-on platform DHS uses for employee authentication.
What surveillance technologies were revealed in the leaked records?
The exposed data shows employee access to several surveillance and monitoring tools, including Penlink location tracking technology used by ICE, Mobile Fortify facial recognition used by both CBP and ICE, and Headspace mental health software. Senior DHS officials also have access to ChatGPT.
