'Department of Peace' Leaks Directory of 40,000+ DHS Employees, Claiming an Okta SSO Source — CBP, ICE, HSI and CISA Staff Exposed

High · 2026-11-08 · By H.A

A hacktivist group leaked names, job titles, mobile numbers and office locations of more than 40,000 DHS staff, claiming they came from an Okta single sign-on system, which Okta says shows no sign of compromise.

Overview

A self-described hacktivist group calling itself "Department of Peace" has leaked a directory of more than 40,000 U.S. Department of Homeland Security employees. The records include names, job titles, mobile phone numbers and office locations. The group says it took the data from an Okta single sign-on (SSO) system used by DHS employees and contractors. Okta says it has no evidence that its own systems were compromised, and DHS has not publicly confirmed how the data was obtained.

The leak came to light on 28 October 2026. Reported totals vary between about 40,000 and almost 42,000 people.

The Incident

Breakdown of the exposed staff as reported:

• about 21,000 from U.S. Customs and Border Protection (CBP);
• about 10,000 from Immigration and Customs Enforcement (ICE) and Homeland Security Investigations (HSI);
• about 1,000 from the Cybersecurity and Infrastructure Security Agency (CISA);
• the rest from other DHS components.

The group says it passed the material to a transparency collective and a Swiss hacker, who published it as a searchable online database. The data reportedly includes staff in sensitive roles such as surveillance and human intelligence. The group says its aim is more oversight of DHS immigration enforcement. A former acting ICE director called the leak a "nightmare scenario" for agents' and families' safety and for ongoing investigations.

The full dataset has not been independently verified. Journalists matched some named employees against credit-bureau and earlier breach records.

Timeline

• Before late October 2026: the data is collected. The method is claimed but not confirmed.
• 28 October 2026: the leak is published and DHS says it is investigating.
• Early November: coverage continues. Okta denies any compromise of its platform, and the attack path is still unconfirmed.

Tradecraft

The claimed SSO source is the most important technical detail. Even if Okta's platform was not breached, a staff directory like this can be pulled through:

• one compromised user or contractor session in the identity tenant, with read access to user profiles;
• over-permissioned API tokens or service integrations able to list users and their attributes;
• downstream applications that sync directory data from the IdP.

Directory attributes such as title, phone and office are often readable by any authenticated user by default. One stolen contractor account can therefore expose a whole department's staff list without anything being "hacked" at the vendor.

Detection

For any organisation running a cloud identity provider:

• Review IdP system logs for large user-listing activity, such as many paged GET /api/v1/users calls in Okta, from unusual tokens, IPs or user agents.
• Audit API tokens and OAuth service apps that have okta.users.read or equivalent scopes. Check who created them and when they were last used.
• Alert on sign-ins to admin consoles or directory APIs from hosting providers, anonymising networks or new devices, especially for contractor accounts.

Recommended Actions

1. Limit which profile attributes ordinary users and integrations can read. Hide mobile numbers and office locations for staff in sensitive roles.
2. Rotate and scope down long-lived API tokens. Prefer OAuth service apps with least-privilege scopes and short-lived credentials.
3. Enforce phishing-resistant MFA and device posture checks for contractors as well as employees.
4. Prepare a doxxing response plan: help exposed staff with data-broker removal, phone-number changes and reporting threats, and warn them about pretexting calls that use the leaked details.
5. Expect follow-on vishing and smishing against exposed staff and their help desks, and tighten identity checks for credential and MFA resets.

Analyst Assessment

This is mainly a doxxing operation, not a classic data breach: no passwords or Social Security numbers are reported. For a law-enforcement workforce, though, names, roles, phone numbers and locations together create real physical and operational risk. Together with the separate FBI job-portal intrusion, it points to a trend of federal personnel data being used as a weapon for pressure and intimidation. Until the access path is confirmed, the most useful lesson is about identity configuration: how much of your directory one ordinary account can enumerate.