Short answer
On October 28, 2026, Distributed Denial of Secrets published data on more than 41,000 DHS employees and contractors that a hacktivist group provided. DHS had not responded to press requests in the reports reviewed, and Reuters verified only part of the dataset.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | U.S. Department of Homeland Security (DHS) |
|---|---|
| Incident type | Data leak |
| Status | Claimed by attackers, unconfirmed |
| Sector | Government |
| Country | United States |
| Disclosed | 2026-10-28 |
| People or records affected | More than 41,000 DHS employees and contractors (CyberScoop). Reuters reported more than 40,000. |
What data was exposed
- Names, phone numbers and email addresses of staff at ICE, CBP, Homeland Security Investigations, CISA and other DHS components
- Job titles and email or user group labels, some indicating special operations, surveillance, computer forensics or undercover work
What happened
On Wednesday, October 28, 2026, Distributed Denial of Secrets (DDoSecrets), a nonprofit that publishes leaked datasets, released internal data on more than 41,000 Department of Homeland Security employees and contractors, CyberScoop reported. DDoSecrets said the data came from a hacktivist group calling itself the Department of Peace, which the outlet says shared it with DDoSecrets and the Swiss hacker maia arson crimew. Crimew put it online in a searchable site.
What DHS has and has not said
As of the reports we reviewed, DHS had not confirmed or denied the leak. Both CyberScoop and Reuters said DHS did not immediately respond to requests for comment. That is why this page labels the incident as unconfirmed by the organization. It is not a statement that the data is fake.
What outside checks found
Independent checks point toward the data being real, at least in part:
- Reuters could not verify the full dataset. It matched personal details for six named employees to credit bureau records and dark web breach data, and it phoned three employees and confirmed their details. One said it was the first they had heard of a breach.
- CyberScoop confirmed that numerous current CISA employees appear in the data, along with former leaders who left years ago. The records span several years, and some group names refer to COVID-19 planning and 2023 internal summits.
- Reuters said some entries mirror public LinkedIn profiles, while others reveal nonpublic org chart details.
How the data was said to be obtained
Emma Best, a DDoSecrets co-founder, told reporters the data was harvested from the Okta single sign-on service that DHS uses. Reuters could not corroborate that. Okta said: “Okta is secure, and we have no evidence our data or systems were compromised.” The Department of Peace said it acted in response to planned increased ICE operations. As of Thursday morning, CyberScoop said the searchable site was offline, though copies may exist elsewhere.
What is still unknown
We do not know how the data was taken, whether the weakness has been closed, or whether DHS will notify staff. The group previously claimed a DHS hack in March, according to Reuters. Details such as exact headcount differ between outlets, and we have not seen the dataset ourselves.
Why it matters for scams
Accurate names, roles and email addresses are what targeted phishing needs. Staff are the likeliest targets, but family members and former colleagues may also receive messages that appear to come from an agency. Read our guides on phishing messages and government impersonation scams, and see what to do after a data breach. How we label claims and confirmations is explained in our editorial policy.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Targeted phishing emails to DHS staff and contractors, using real names, job roles and colleagues' addresses to look credible.
- Impersonation of DHS or agency IT help desks asking employees to 'reset' single sign-on credentials.
- Phone and text scams that use accurate contact details to pose as a supervisor, HR or a federal investigator.
- Harassment, doxxing and threats aimed at named employees, and extortion attempts that cite their data.
What to do if you are affected
- 01DHS staff and contractors: treat unexpected messages about account resets, benefits or investigations as suspect and verify through a known internal channel.
- 02Use phishing-resistant multi-factor authentication where available, and report suspicious messages to your security office.
- 03Review personal exposure: limit public details online and use a credit freeze if you are concerned about identity misuse.
- 04Anyone who gets a call or email claiming to be from DHS should not give out personal information or payment. Hang up and contact the agency through its official website.
- 05Do not download or share the leaked dataset, which may be used as bait for malware.
Frequently asked questions
Did DHS confirm the employee data leak?
Not in the reports we reviewed. Both CyberScoop and Reuters said DHS did not immediately respond to requests for comment.
How many DHS employees were in the leak?
CyberScoop reported more than 41,000 employees and contractors. Reuters reported more than 40,000. Counts vary by outlet.
Who leaked the DHS employee data?
Distributed Denial of Secrets published it. It said the data came from a hacktivist group calling itself the Department of Peace, which previously claimed a DHS hack in March.
Is the DHS leak real?
Reuters could not verify the whole dataset but matched six named employees to credit bureau and breach records and confirmed details by phone with three. CyberScoop confirmed that many current CISA employees appear in it.
How was the DHS data obtained?
DDoSecrets co-founder Emma Best said it was taken from the Okta sign-on service DHS uses. Reuters could not corroborate that, and Okta said it has no evidence its data or systems were compromised.
Sources
- DHS employee data leak by DDoSecrets, CyberScoop, 2026-10-29
- Leak website releases data on tens of thousands of DHS employees, Reuters (via GV Wire), 2026-10-28
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.