Hacker Leaks Personal Data of > 40,000 U.S. Department of Homeland Security Employees
What Happened — A self‑identified hacktivist calling themselves “Department of Peace” posted a database containing names, job titles, work email addresses, cell phone numbers and office locations for more than 40,000 DHS personnel. The data set spans Customs and Border Protection, Immigration and Customs Enforcement, the Cybersecurity and Infrastructure Security Agency and other DHS components. The actor claims the information was taken from an Okta single‑sign‑on (SSO) platform that DHS uses to manage employee and contractor access, but the exact breach method has not been disclosed. DHS confirmed it is aware of a potential breach and is investigating.
Why It Matters for Trust & Control Assurance — The incident highlights the need for strong identity‑and‑access‑management controls, continuous monitoring of privileged accounts, and auditable evidence of who can access critical systems.
Who Is Affected — Federal government (DHS, CBP, ICE, CISA) and their contractors.
Recommended Actions
- Review and harden SSO configurations (enforce MFA, limit admin scopes).
- Implement continuous logging and real‑time alerts for privileged‑account activity.
- Conduct an IAM audit and map findings to your audit‑readiness framework.
- Update incident‑response playbooks to include credential‑theft scenarios.
Source: SecurityAffairs
Technical Notes
- Alleged source: Okta SSO platform (no public confirmation).
- Exfiltrated data: employee names, titles, work email, cell phone, office location.
- No malware or ransomware reported; breach vector remains unknown.