A leaked database has exposed the names and work contact details of more than 40,000 Department of Homeland Security employees, including ICE and Border Patrol personnel. DHS says it is investigating.
The U.S. Department of Homeland Security is investigating a previously undisclosed breach of its personnel records after a database containing the names, job titles and work contact details of more than 40,000 employees and contractors was published online on Wednesday.
DHS said in a statement that it was "aware of a potential breach and is actively working to address the situation swiftly and effectively," adding that it was taking steps to "ensure all are properly protected." The department has not confirmed the number of records involved, how the data was obtained, or whether the breach has been contained.
What the dataset contains
According to an analysis of the published files by TechCrunch, the records include names, job titles, work email addresses, work-issued cell phone numbers and office locations. More than half of the dataset, roughly 21,000 records, relates to employees of U.S. Customs and Border Protection, who are stationed at airports and other ports of entry. Another 10,000 records relate to Immigration and Customs Enforcement and its Homeland Security Investigations unit, including personnel listed as working in undercover or covert roles.
The material also includes IT and login records tied to employee accounts, indicating which internal systems and applications each person was permitted to access, according to the hacker's account. The database represents roughly a fifth of DHS's workforce of about 220,000 people, and is therefore far from complete.
How it surfaced
The leak was published by Distributed Denial of Secrets (DDoSecrets), a nonprofit collective that releases hacked and leaked datasets it deems in the public interest. The group said the data came from a hacker using the handle "Department of Peace," who claimed to have obtained it by compromising an Okta single sign-on system used across DHS agencies.
The hacker also shared the material with U.S. journalist Ryan Ottignon and Swiss security researcher maia arson crimew, who built the searchable database, Ottignon told NPR. DDoSecrets co-founder Emma Best described the release as "extraordinary but deceptive in its simplicity," saying it draws explicit connections between officials responsible for overseeing covert operations and staff tied to deportation and rendition programs.
In a note accompanying the files, DDoSecrets wrote: "They have our information, so it's only fair that we have theirs."
Differing characterisations
Those behind the release reject the description of the publication as doxing. Ottignon argued that officials who operate in public while masking their identities need external oversight, and described the release as "one step in that oversight process." Researchers examining the Trump administration's immigration enforcement have said the records could be valuable for pursuing public records requests, which often fail when the names or email addresses of officials are unknown.
Officials have not publicly addressed that argument. The breach follows a similar hacking incident at the FBI disclosed in late September, and raises questions about the security of the identity infrastructure that sits beneath multiple federal agencies rather than a single department.
Platforms move to limit access
On Thursday, Bluesky began blocking links to the DDoSecrets website, flagging them as "malicious." The company has not commented publicly on the decision. Bluesky's policy prohibits the sharing of personal information without authorization, but the move drew criticism from users who argued the block restricts access to material of public interest.
Whether other platforms and search providers follow will shape how widely the dataset circulates. Reuters, citing DDoSecrets, reported that the material was released on Wednesday.
Open questions
Several central facts remain unconfirmed. DHS has not said when the Okta system was compromised, whether law enforcement or a third-party forensic firm is involved, or whether employees have been notified. The claim that the intrusion occurred through Okta has not been corroborated by the department or the company. Gloobeam has not independently verified the contents of the published dataset and has made no attempt to access it.