A threat actor has leaked a database that reportedly contains the names, job titles and work contact details of more than 41,000 employees and contractors at the US Department of Homeland Security (DHS). The data was published online on October 28, 2026, and the threat actor claims it was taken from an Okta single sign-on (SSO) system that DHS staff use to log in to the department’s central network.
DHS said it is aware of a “potential breach” and is working to address it. Okta said its own platform was not compromised. How the attacker got in, and whether that access has been closed, has not been made public.
What the leaked records reportedly contain
According to people who reviewed the files, each record ties a DHS user account to personal and work information, including:
- Names and job titles of employees and contractors
- Work email addresses and phone numbers, including mobile numbers
- Office locations and assignments within DHS components
- Access records showing which internal systems, apps and user groups each account belongs to
Journalists who examined the dataset reported that a portion matched the names of known DHS employees, and that timestamps on the records point to the data being copied around mid-August 2026. The newest records are reportedly dated August 19, 2026. Some user group names reference planning work from 2023, which suggests the directory carries years of history.
CBP and ICE staff make up most of the dataset
Reports put more than half of the records, about 21,000, with US Customs and Border Protection (CBP). Roughly 10,000 records reportedly belong to Immigration and Customs Enforcement (ICE), including its Homeland Security Investigations (HSI) unit. About 6,200 are tied to US Citizenship and Immigration Services, and close to 1,000 are linked to the Cybersecurity and Infrastructure Security Agency (CISA), more than half of them contractors. Staff at DHS headquarters and the Federal Protective Service also appear in the files.
The group that published the archive said the leak was not a full staff directory. It claimed the records identify officials who oversee covert and undercover operations and key personnel in removal and deportation programs. Those claims have not been independently confirmed. A searchable website built from the data was taken offline by its domain registrar by October 29.
The threat actor left a note with the files stating, “They have our information, so it’s only fair that we have theirs,” and described the leak as a response to stepped-up immigration enforcement.
DHS and Okta respond
“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a DHS spokesperson said in a statement to reporters. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”
Okta pushed back on any suggestion that its service was breached. “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised,” an Okta spokesperson said. The company’s statement does not rule out access through a compromised DHS account, integration or misconfiguration on the customer side, and no root cause has been confirmed.
DHS had not published a formal breach notice on its website at time of publication.
Why access data raises the stakes
Contact details alone make employees easier to reach with targeted phishing and impersonation. The access records may be the more serious problem. A map of which people can reach which systems tells an attacker exactly who to target next to get into a specific application. That risk extends to the CISA staff and contractors in the files, who work on defending federal networks.
The exposure also creates physical safety concerns for law enforcement officers whose names, offices and phone numbers are now public. Federal staff listed in the data should expect a rise in phishing, smishing and pretext calls that use real job titles and office details to appear legitimate.
Organizations that run SSO for large workforces can reduce the impact of this kind of theft by moving users to phishing-resistant MFA, limiting which admin and API tokens can export directory data, and alerting on bulk reads of user and group records.
Another hit on federal personnel data
The leak follows a string of incidents involving US government staff data in 2026. BreachNews has covered the cyber incident affecting the Homeland Security Information Network, the theft of FBI employee data in a ShinyHunters cyberattack and a Pentagon data breach exposing military personnel records. The same threat actor reportedly claimed an earlier theft of DHS contracts with private sector vendors this year.
BreachNews will update this story as DHS shares more about how the data was accessed and whether affected employees will be notified.
