A hacker operating under the handle "Department of Peace" has stolen and disclosed the personal information of more than 41,000 employees of the U.S. Department of Homeland Security, including staff at U.S. Immigration and Customs Enforcement and Customs and Border Protection, according to reports from TechCrunch and Wired first summarized by The Verge. The compromised dataset is not merely a directory of federal workers: according to those reports, it also links the affected agencies to specific surveillance tools, turning what might have been an embarrassing leak into a disclosure with potential operational and human consequences.
The incident, which surfaced across international outlets this week — from NBC News and MSN to L.A. Taco and South Korea's Digital Today — is being treated as one of the more consequential federal data exposures in recent years, both for the volume of records involved and for what those records reveal about how the government surveils people.
What was taken
According to The Verge's account of the TechCrunch and Wired reporting, the exposed records include a standard but sensitive set of personnel details:
- Full names and job titles
- Phone numbers and email addresses
- Office locations and agency affiliations
- Data connecting agencies to particular surveillance technologies
Roughly 21,000 of the records belong to CBP employees, with the remainder spread across ICE and other DHS components. The leak therefore touches three of the most scrutinized law-enforcement and border agencies in the federal government, each of which has been the subject of sustained congressional oversight and civil-liberties litigation.
An identity provider as the weak link
According to TechCrunch, the intruder gained access through Okta, an identity and access management service widely used across the federal government and the private sector to handle single sign-on and authentication. That detail is likely to intensify scrutiny of the third-party vendors that sit at the center of government authentication — services that, by design, hold the keys to many doors at once.
Okta is no stranger to attacker attention. The company disclosed in 2022 that it had been targeted by the Lapsus$ extortion group, an episode that prompted a broad review of how much trust enterprises place in identity providers. Security researchers have long warned that a single compromised identity layer can convert what would otherwise be isolated intrusions into sprawling, cross-agency exposures — precisely the pattern described here, where records from multiple DHS components appear in a single dataset.
Undercover agents and the surveillance angle
Different outlets have framed the story differently, and the divergence is instructive. The Verge emphasizes the technical vector and the surveillance-tool linkage, treating the breach as a story about vendor risk and government secrecy. NBC News leads with the human stakes, reporting that the hack exposed the names of roughly 40,000 employees including undercover ICE agents — a claim advanced by activists rather than confirmed by the department. L.A. Taco, a Los Angeles publication with deep coverage of immigration enforcement, centers the consequences for the communities most affected by ICE and CBP activity.
That framing matters. If the data genuinely identifies agents working in an undercover capacity, the risk is not limited to spam calls and phishing attempts: it extends to the physical safety of officers and to the integrity of ongoing investigations and operations. Advocates have argued for years that immigration enforcement agencies are unusually opaque about staffing, and that the sudden disclosure of personnel rosters could cut both ways — exposing individual officers to harassment while also giving the public an unprecedented window into an apparatus that rarely volunteers details about itself.
The data did not merely identify employees; it reportedly linked their agencies to specific surveillance tools — a detail that raises questions about operational security as much as personal privacy.
Breached again
Digital Today's headline described the incident bluntly: the U.S. Department of Homeland Security has been breached again. That framing captures a growing frustration among security professionals. Federal agencies have spent the better part of a decade migrating to cloud services, adopting multi-factor authentication, and hardening perimeter defenses, yet the most damaging exposures increasingly arrive through trusted intermediaries — contractors, identity providers, and integrated software platforms — rather than through direct attacks on government networks.
The breach also lands in a broader pattern of leak-site activity in which self-styled hacktivists publish stolen data to make political points rather than to extract ransom. The "Department of Peace" moniker fits that mold, and the choice to disclose rather than sell the data suggests the motivation is at least partly ideological.
The FBI steps in
North Country Public Radio reported that the FBI is hunting the hackers responsible for stealing sensitive employee data, indicating that federal law enforcement has opened an investigation into the intrusion. DHS has not publicly confirmed the full scope of the compromised records, and it remains unclear whether the dataset posted online is complete or has been augmented or altered — a common complication in leak investigations, where fabricated or outdated entries are often mixed with genuine ones.
Questions also remain about timing: when the initial access occurred, how long the intruder maintained a foothold, and whether Okta or DHS detected the activity before the data surfaced publicly. Neither the department nor Okta has offered a detailed public accounting.
What happens next
For federal employees caught up in the leak, the immediate practical fallout is familiar: heightened risk of phishing, spear-phishing, and social-engineering attacks that exploit real names, titles, and office locations. Security experts routinely advise affected personnel to assume their details are in circulation and to verify unexpected contacts through independent channels.
The larger question is institutional. Lawmakers have repeatedly pressed agencies on supply-chain security, and the Okta angle gives those arguments fresh ammunition. If a single identity provider can be leveraged to pull records from ICE and CBP at once, then the government's authentication architecture is only as strong as its weakest vendor — and the surveillance disclosures buried in the dataset suggest the stakes go well beyond individual privacy.
"Breached again" may be the most telling phrase to emerge from the coverage. As the FBI investigation proceeds, the pressure will be on DHS and its contractors to explain not only how the data left the building, but why so much of it was linked together in a form that could be taken in a single sweep.
