A hacktivist group calling itself Department of Peace says it took personnel data on more than 40,000 Department of Homeland Security employees and contractors from an Okta single sign-on service, and Distributed Denial of Secrets (DDoSecrets) published it on October 28, 2026. Okta says it has no evidence its systems were compromised. DHS says it is aware of a potential breach and is working to address it.
Several outlets report the figure as roughly 40,000 to 41,000 people. A widely shared social post said "over 20,000" and called the hack "catastrophic." The first number is an undercount against current reporting, and the second is a characterization we could not trace to an official DHS statement. This post separates what has been verified from what is only claimed.
We do not link to the leaked data and recommend you do not search for it. The records identify law enforcement and security staff.
TL;DR
| Question | Answer |
|---|---|
| What was leaked? | Personnel data on 40,000+ DHS employees and contractors |
| Who published it? | Distributed Denial of Secrets, from data given by a hacker called Department of Peace |
| Which agencies? | CBP (about 21,000), ICE and HSI (about 10,000), CISA (just under 1,000), others |
| How was it taken? | Claimed: from an Okta SSO service. Okta denies compromise. Unconfirmed |
| Is the data real? | At least partly: TechCrunch and CyberScoop verified samples |
| What does DHS say? | "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively." |
| What should orgs do? | Review SSO admin access, tokens and export logs; warn staff about targeted phishing |
What was exposed
Per TechCrunch, which examined an offline copy:
| Item | Detail |
|---|---|
| Identity fields | Names, job titles, work email addresses, cell phone numbers, office locations |
| IT data | Login records and which internal apps and groups each user can access |
| Timing | Records appear to date from around mid-August, based on timestamps |
| Share of DHS | Roughly one-fifth of a workforce of about 220,000 |
| CBP | About 21,000 records, more than half the dataset |
| ICE and HSI | About 10,000 records |
| CISA | Just under 1,000 records |
| Other | Thousands more, including headquarters, USCIS and the Federal Protective Service |
CyberScoop adds that the data goes back years: it found former CISA leadership who left long ago, and group names referencing COVID-19 planning and 2023 internal summits.
What the access-group data reveals
The access groups are a second layer of exposure, because they show which tools staff use. TechCrunch reports:
- Most employees are in groups for Microsoft 365, Adobe Acrobat and Citrix.
- About 4,500 users belong to a "Headspace_users" group. Headspace had an $82,500 ICE contract that ended in 2023 and says it has provided no services since.
- Dozens of groups reference Penlink, a location-tracking surveillance vendor with a long-running ICE contract. Penlink did not respond to comment requests.
- More than 200 CBP users are linked to the Mobile Fortify facial-recognition app.
- Some employees, including senior officials, have ChatGPT access.
- Other groups relate to investigations of China-backed hacking groups Salt Typhoon and Volt Typhoon.
Claimed vs verified
| Item | Status |
|---|---|
| Data published by DDoSecrets | Reported by TechCrunch and CyberScoop |
| More than 40,000 people | Reported figure; CyberScoop says 41,000+. DHS has not confirmed a number |
| Data is authentic | Partly verified: TechCrunch matched several known employees; CyberScoop confirmed numerous current CISA staff |
| Taken from an Okta SSO service | Claimed by Department of Peace; not confirmed |
| Okta was compromised | Denied by Okta ("no evidence our data or systems were compromised") |
| DHS aware of a potential breach | Stated by DHS |
| Searchable site hosting the data offline | Reported as of the morning of October 29 |
| Motive: response to ICE operations | Claimed by the group; CyberScoop cites its reference to the DHS Secretary's July statement |
| "Catastrophic" | Attributed to sources in the tweet's framing; not an official DHS finding we could find |
| Vulnerability fixed, or DHS knew before publication | Unknown |
An important nuance: Okta saying it has no evidence its own systems were compromised is consistent with a breach of DHS's tenant or of an administrator account, because that would not be a compromise of Okta's platform. Neither side has said which it is, and we do not know.
Why SSO directories are valuable targets
An identity provider holds a directory of every person, their contact details, their groups and the apps they can reach. A directory export is a ready-made target list for phishing, impersonation and social engineering, and the group data tells an attacker which tools to imitate.
If your organization runs SSO, check these now:
- Admin roles. Who has super-admin or API-admin rights? Remove standing access; use time-limited elevation.
- API tokens. List every active token and its owner. Revoke unused ones, scope the rest, and rotate any you cannot account for.
- Phishing-resistant MFA for admins and anyone with directory read access (FIDO2 keys or passkeys), not SMS or push-only.
- Export and bulk-read alerting. Alert on large directory reads, user list exports and new API tokens. The leak shows value in the list itself.
- Session and device policy for admin sessions: short lifetimes, managed devices only.
- Review third-party access, such as contractors, help-desk tools and sync integrations with directory permissions.
- Prepare staff warnings. After a directory leak, expect convincing phishing, vishing and impersonation using real job titles and contact details.
For an incident runbook, see your first 24 hours after a vendor breach.
What affected staff should do
If you work at DHS or a contractor and think your details may be in the data, follow your agency's guidance. In general: treat unexpected calls, texts and emails citing your role as suspect, verify through a known channel, review your mobile carrier account for SIM-swap protection, and report suspicious contact to your security office. Data about law enforcement staff can also create physical-safety risks, so use the official reporting channels.
The AI tools angle
The access-group data lists tools staff can use, including ChatGPT for some employees. It is a useful reminder that an SSO directory is also an inventory of the AI tools in your organization. Know which AI tools and agents your staff can reach, what they can read, and whether that list is itself exposed. For agent-specific risks, see our Accenture contractor and DoD credentials claimed vs verified post.
How Beam handles this
Beam is a local-first monitor for AI coding agents. It does not connect to Okta, DHS systems or any identity provider, and it cannot tell whether your tenant was affected. If your team uses coding agents, it can flag when an agent reads credential files or runs unexpected commands on a developer machine, which is separate from this incident.
What we do not know
- How the data was actually obtained. Okta's denial and the group's claim cannot both be checked from public information.
- Whether DHS knew of the theft before publication, and whether the weakness has been fixed.
- The exact record count. Estimates range from 40,000 to 41,000+, and DHS has not published one.
- Whether the data was taken in one event around mid-August or collected over time.
- Whether any contractor or vendor systems were involved.
We read the TechCrunch and CyberScoop reports in full. The CBC article returned an access error, and we did not open the Fox News, CNN or Washington Post pieces ourselves, so the "catastrophic" wording and other details from those outlets come only from search summaries and the tweet. DHS has not published a detailed statement beyond one line. Figures and attribution may change.
Related reading
- Accenture contractor, Claude Code and DoD credentials: claimed vs verified
- Warp vendor breach: agent traces and telemetry, claimed vs verified
- Your first 24 hours after a vendor breach: a rotation and monitoring runbook
- Binance security incident: compromised DevOps laptop, withdrawals suspended
- October 2026 attacks timeline
Reporting: TechCrunch, Oct 28 · CyberScoop · CBC · America's Newsroom on X
Accurate as of October 30, 2026. This is a developing story; counts, attribution and the entry point are unconfirmed.