40,000+ DHS Staff Exposed: Leak Lists ICE and CBP Roles Including Undercover Work, Okta Denies Breach

Personal and work details of more than 40,000 US Department of Homeland Security (DHS) employees have been published online, in what Reuters describes as the third major government data leak to make headlines in a month.

Distributed Denial of Secrets (DDoSecrets), a nonprofit that publishes leaked data, said on October 28, 2026 that it had released the records. DHS says it is aware of "a potential breach."

What data was leaked? #

According to Reuters, the records include:

• names, phone numbers and email addresses
• job titles and internal email groups, some of which indicate assignments to special operations, surveillance, computer forensics and undercover work

Staff from several DHS components appear in the data, including Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), Homeland Security Investigations (HSI) and the Cybersecurity and Infrastructure Security Agency (CISA).

Reuters says some of the data matched public LinkedIn profiles, while other parts revealed nonpublic org chart details or previously undisclosed programs. A searchable public tool for the data has also been built, according to DDoSecrets. AppSecNews is not linking to it.

Who is behind the DHS leak? #

DDoSecrets attributed the data to a group calling itself the Department of Peace, which previously claimed a DHS hack in March. The group said DHS employees "have our information, so it's only fair that we have theirs." It did not respond to Reuters' request for comment.

Was Okta breached? #

DDoSecrets co-founder Emma Best said the group obtained the data from the Okta single sign-on service used by DHS. Okta denies a compromise:

"Okta is secure, and we have no evidence our data or systems were compromised."

Reuters said it could not corroborate the claim that the data came from Okta. A single sign-on service holds a directory of user accounts, so a compromised DHS tenant or admin account would not necessarily mean Okta's own systems were breached; how the data was taken has not been established.

How much of the leak is verified? #

DHS said it was "aware of a potential breach and is actively working to address the situation swiftly and effectively," and that it would share more information when available.

Why does this matter? #

Exposed names, roles and contact details for law enforcement and intelligence staff can be used for harassment, targeted phishing, impersonation and foreign intelligence targeting. The leak follows a September claim by the ShinyHunters group of stolen FBI employee data, Reuters notes.

What should organizations and affected staff do? #

1. Expect targeted phishing. Affected employees should treat unexpected calls, texts and emails that reference their role with suspicion and verify through official channels.
2. Lock down personal exposure. Use data broker opt-out services and review public social media profiles that mention roles or locations.
3. Audit SSO tenants. Organizations using Okta or other identity providers should review admin accounts, API tokens and directory export activity for anomalies.
4. Limit directory data. Restrict who and what can read full staff directories, including job titles and group memberships.
5. Monitor for impersonation. Watch for fake accounts and lookalike domains targeting employees and their contacts.