A hacktivist crew called Department of Peace handed a directory of internal DHS records to the transparency nonprofit Distributed Denial of Secrets and the hacker known as maia arson crimew, and this week it became public. More than 41,000 current and former Department of Homeland Security employees and contractors appear in the archive.
The exposed fields run to names, job titles, work email addresses, cell phone numbers and office locations. More than half, roughly 21,000 records, belong to Customs and Border Protection staff at airports and ports of entry, about 10,000 map to Immigration and Customs Enforcement and its Homeland Security Investigations unit, and just under 1,000 sit with CISA. Thousands more fall under DHS headquarters, Citizenship and Immigration Services and the Federal Protective Service.
The crew says it pulled the material from an Okta single sign-on tenant, the identity layer that routes DHS employees and contractors into the central network and keeps login records plus permission maps of the applications each account can reach. According to the vendor, the Okta service itself is secure and nothing suggests its systems were breached. DHS was asked for comment and had not answered by publication.
Group names inside the files point to COVID-19 planning and 2023 internal summits, evidence that the material reaches back years. DDoS Secrets founder Emma Best called the release extraordinary, pointing to officials who oversee covert and undercover work, the hunt for leakers, and personnel in rendition and deportation programs. CyberScoop verified that current CISA employees appear along with leaders who left years ago. Department of Peace framed the publication as payback for enforcement promises DHS Secretary Markwayne Mullin made in July. By Thursday morning the searchable site was offline, though copies circulate. The lesson is that identity providers index exactly the org chart an adversary wants.
