Data Breach Exposes Personnel Information of Thousands in Homeland Security, Including CBP and ICE Agents

A significant breach has resulted in the exposure of personal information belonging to numerous employees of the U.S. Department of Homeland Security. The security incident, which occurred earlier this year, has now come to light.

The compromised data includes personal identifiers, job positions, and work-related contact details—such as email addresses, phone numbers, and office locations—pertaining to over 40,000 federal employees, including border agents, cybersecurity professionals, and high-ranking officials.

The hacker, using the alias Department of Peace, claimed to have extracted this data from an Okta single sign-on system that Homeland Security employs for various employees and contractors to access its central network. This Okta platform also holds IT and login records linked to the employees’ accounts, detailing the systems and applications they are authorized to use.

A notable portion of the dataset—approximately 21,000 records—pertains to employees at U.S. Customs and Border Protection (CBP), who are stationed at airports and other points of entry. Additionally, it encompasses records from about 10,000 personnel from Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) sector, along with nearly 1,000 employees from CISA, the U.S. cybersecurity defense agency.

The dataset also includes thousands of records of employees from the department’s headquarters and other agencies, such as the U.S. Citizenship and Immigration Services and the Federal Protective Service.

“They have our information, so it’s only fair that we have theirs,” stated Department of Peace in a note accompanying the data. The hacker did not respond to inquiries regarding the breach’s execution and the methods used.

This incident adds to a series of data breaches impacting the U.S. government in recent months, which have included unauthorized access to personnel files of FBI agents and sensitive information from millions of military personnel held by the Pentagon’s HR unit. It is also the second breach involving Homeland Security this year, as the same hacker previously claimed to have stolen contracts between the department and private sector entities.

The latest data leak, which has been deemed authentic, provides a glimpse into the operations of Homeland Security, raising concerns among voters regarding deportations, arbitrary detentions, and incidents involving U.S. citizens as the midterm elections approach.

The stolen data was given to journalist and hacker maia arson crimew, who subsequently shared it with DDoSecrets, a collective committed to hosting leaked information for public benefit.

Verification efforts by TechCrunch affirmed some of the data’s authenticity by cross-referencing the names of several known employees with an offline version of the database. It appears that these records were extracted around mid-August, suggesting a breach involving about one-fifth of Homeland Security’s total staff of roughly 220,000 individuals.

The status of the vulnerability that allowed this breach remains uncertain, as does Homeland Security’s awareness of the incident.

A representative from Homeland Security did not provide a prompt response regarding the breach. Meanwhile, an Okta spokesperson acknowledged the report, asserting, “Okta is secure, and we have no evidence our data or systems were compromised.”

In addition to revealing personal details about agents and officers, the data also sheds light on the surveillance technologies and cybersecurity tools accessible to Homeland Security employees. There are calls for investigations into tech firms supplying hardware and software to ICE.

The leaked dataset outlines employees’ memberships in user groups within the department’s Active Directory system, which governs access to internal tools and services along with third-party applications used for official duties.

Most employees represented in the dataset were linked to user groups with access to Microsoft 365, a cloud service hosting the agency’s emails and documents. Additionally, there are user groups granting access to Adobe Acrobat, Citrix, and standard desktop software applications.

Among the data, approximately 4,500 users, including ICE agents and deportation personnel, belong to a group labeled “Headspace_users.” This group had previously been associated with an $82,500 federal contract with ICE to provide mental health resources for its personnel.

A representative from Headspace confirmed that no services had been provided to DHS or ICE since 2023.

Numerous other user groups mention Penlink, a surveillance company with technology purported to track the location data of millions of mobile devices, which has contracted with ICE for years. The group sizes range from a few users in local Homeland Security offices to over 2,000 users in ICE’s HSI unit nationally.

One specific group linked to Penlink PLX is reportedly utilized for gathering and analyzing intelligence from various communication forms, including phone calls and social media.

A request for comment from Penlink went unanswered.

Additionally, one user group includes over 200 CBP users linked to Mobile Fortify, a facial-recognition application used by both CBP and ICE agents for identifying individuals and verifying their immigration statuses.

Other groups include DHS officials with access to ChatGPT, as well as those responsible for investigations into China-linked cyber threat groups known as Salt Typhoon and Volt Typhoon.

Public advocates and researchers assert that the exposed data could yield significant leads for probing alleged abuses linked to the Trump administration, including identifying agents’ email addresses for public records requests.

“Email addresses and phone numbers are invaluable tools for FOIA researchers, often being crucial for generating effective requests,” noted Ryan Shapiro, executive director of the transparency nonprofit Property of the People.

“With the prevailing lack of transparency during the Trump administration, these tools are more necessary than ever,” added Shapiro.

Emma Best, co-founder of DDoSecrets and journalist, expressed that the disclosed Homeland Security data will serve as a stimulus for investigations, aiding journalists, Congressional inquiries, legal actions, community movements, and Freedom of Information Act requests.