Over 40,000 Homeland Security Staff Records Published Online

More than 40,000 U.S. Department of Homeland Security employees had their personal data published on a leak website on Wednesday. The release includes names, phone numbers, email addresses, and job titles for staff across multiple agency components. Specific details reveal assignments in surveillance, computer forensics, and undercover operations.

The data was released by Distributed Denial of Secrets, a non-profit data transparency group. The organization stated the information was obtained from an entity calling itself the Department of Peace. This disclosure follows two other major government security incidents in the past month. In September, the hacking group ShinyHunters claimed to have stolen data from the Federal Bureau of Investigation. Last week, the U.S. War Department faced a class-action lawsuit after a breach exposed records for millions of current and former military personnel.

DHS said in a statement that it is aware of the potential breach and is actively working to address the situation swiftly. The agency indicated it is ensuring employees are properly protected and will update the public when more information becomes available. The leaked data covers personnel from Immigration and Customs Enforcement, Customs and Border Protection, Homeland Security Investigations, and the Cybersecurity and Infrastructure Security Agency.

Emma Best, co-founder of Distributed Denial of Secrets, said a hacktivist known as "maia arson crimew" developed a search tool for the data. Best stated the tool would "replace anonymity with accountability" to help journalists and boost congressional oversight. The Department of Peace said in a statement that it hoped the data would limit further harm by DHS. The group claimed in March to have hacked DHS to post vendor contract documents.

The Department of Peace said it harvested the data from the Okta sign-on service used by DHS. Okta responded to a Reuters query by stating that it is secure and has no evidence its data or systems were compromised. Reuters could not immediately corroborate the claim but matched personal information for six named employees to credit bureau records and dark web breach data. The news agency confirmed phone numbers for three employees by direct call.

In some cases, the leaked information matched profiles available on LinkedIn. In other instances, the data revealed non-public internal organization charts and previously undisclosed programs. One employee told Reuters it was the first they had heard of a breach. The Department of Peace did not immediately respond to a request for comment beyond its initial statement.