--- title: Hacker stole personnel data about thousands of Homeland... description: A hacker stole personnel records of more than 40,000 Homeland Security employees and published them online. The data, allegedly taken from an Okta single... canonical: https://daily.dev/posts/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-ag-lawntarjr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents | daily.dev og:description: A hacker stole personnel records of more than 40,000 Homeland Security employees and published them online. The data, allegedly taken from an Okta single... og:url: https://daily.dev/posts/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-ag-lawntarjr og:image: https://api.daily.dev/og/posts/LAWNTARJr.png og:image:alt: Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents **[TechCrunch](https://daily.dev/sources/tc)** · 6 min read · 0 upvotes · 0 comments ## Summary A hacker stole personnel records of more than 40,000 Homeland Security employees and published them online. The data, allegedly taken from an Okta single sign-on system, includes names, job titles, emails, phone numbers and office locations. More than 21,000 records belong to CBP staff, 10,000 to ICE and HSI employees, and nearly 1,000 to CISA staff. The records, exfiltrated around mid-August, also reveal access groups tied to tools like Penlink, Mobile Fortify facial recognition and ChatGPT. Okta says it found no evidence its systems were compromised, and DHS has not confirmed the breach. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many Homeland Security employees had their personal data exposed in the Okta-linked breach? More than 40,000 Homeland Security staffers had their personally identifiable information published online, including names, job titles, work emails, cell phone numbers and office locations. More than 21,000 records belonged to Customs and Border Protection employees, about 10,000 to ICE and its HSI unit, and nearly 1,000 to CISA staff. A hacker going by 'Department of Peace' claimed to have obtained the data from an Okta single sign-on system used across DHS agencies. _Developers securing identity systems can follow breach disclosures like this one on daily.dev to spot emerging SSO attack patterns._ ### Did Okta confirm a breach of its systems in the Homeland Security data leak? No, Okta said it found no evidence that its own data or systems were compromised, even though the hacker claimed to have pulled the leaked Homeland Security personnel data from an Okta single sign-on system used by the department. DHS itself did not respond to requests for comment about the breach, and it remains unclear whether the underlying vulnerability was fixed. _Teams evaluating SSO vendor risk can track how incidents like this unfold on daily.dev._ ### What third-party tools were linked to ICE and CBP employee access groups in the leaked DHS data? The leaked Active Directory group data showed ICE and CBP employees with access to Microsoft 365, Adobe Acrobat, and Citrix, plus surveillance-specific tools. About 4,500 users, including ICE deportation officers, belonged to a 'Headspace_users' group tied to a since-expired therapy contract, over 2,000 HSI users had Penlink web surveillance access, and 200+ CBP users were linked to the Mobile Fortify facial-recognition app. _Anyone researching government surveillance tech stacks can keep up with disclosures like this on daily.dev._ ## Similar posts on daily.dev - [US government says it got hacked — again](https://daily.dev/posts/us-government-says-it-got-hacked-again-portisxb8) · TechCrunch · 0 upvotes · 0 comments - [StopICE alerts hacked to sen texts , admins accuse CPB agent](https://daily.dev/posts/stopice-alerts-hacked-to-sen-texts-admins-accuse-cpb-agent-2vueyufdz) · The Register · 0 upvotes · 0 comments - [2.7 million hit in workplace benefits data breach exposing SSNs, dates of birth and health account data](https://daily.dev/posts/2-7-million-hit-in-workplace-benefits-data-breach-exposing-ssns-dates-of-birth-and-health-account-d-g44lfrkw5) · IT Security Guru · 0 upvotes · 0 comments - [One Insider, Three Email Accounts, and 200,000 Files Show How Breaches Expand](https://daily.dev/posts/one-insider-three-email-accounts-and-200-000-files-show-how-breaches-expand-wftbfn2ng) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#cloud](https://daily.dev/tags/cloud), [#cyber](https://daily.dev/tags/cyber), [#data-breach](https://daily.dev/tags/data-breach), [#okta](https://daily.dev/tags/okta) [View this post on daily.dev](https://daily.dev/posts/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-ag-lawntarjr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents","url":"https://daily.dev/posts/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-ag-lawntarjr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-ag-lawntarjr"},"datePublished":"2026-10-28T20:02:44.247Z","dateModified":"2026-10-30T16:02:58.942Z","description":"A hacker stole personnel records of more than 40,000 Homeland Security employees and published them online. The data, allegedly taken from an Okta single...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bf359f7346218832e9d406cd0313ae86?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bf359f7346218832e9d406cd0313ae86?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"TechCrunch","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"TechCrunch","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tc","url":"https://daily.dev/sources/tc"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-ag-lawntarjr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cloud,cyber,data-breach,okta","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"TechCrunch","item":"https://daily.dev/sources/tc"},{"@type":"ListItem","position":3,"name":"Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-ag-lawntarjr#faq","mainEntity":[{"@type":"Question","name":"How many Homeland Security employees had their personal data exposed in the Okta-linked breach?","acceptedAnswer":{"@type":"Answer","text":"More than 40,000 Homeland Security staffers had their personally identifiable information published online, including names, job titles, work emails, cell phone numbers and office locations. More than 21,000 records belonged to Customs and Border Protection employees, about 10,000 to ICE and its HSI unit, and nearly 1,000 to CISA staff. A hacker going by 'Department of Peace' claimed to have obtained the data from an Okta single sign-on system used across DHS agencies. Developers securing identity systems can follow breach disclosures like this one on daily.dev to spot emerging SSO attack patterns."}},{"@type":"Question","name":"Did Okta confirm a breach of its systems in the Homeland Security data leak?","acceptedAnswer":{"@type":"Answer","text":"No, Okta said it found no evidence that its own data or systems were compromised, even though the hacker claimed to have pulled the leaked Homeland Security personnel data from an Okta single sign-on system used by the department. DHS itself did not respond to requests for comment about the breach, and it remains unclear whether the underlying vulnerability was fixed. Teams evaluating SSO vendor risk can track how incidents like this unfold on daily.dev."}},{"@type":"Question","name":"What third-party tools were linked to ICE and CBP employee access groups in the leaked DHS data?","acceptedAnswer":{"@type":"Answer","text":"The leaked Active Directory group data showed ICE and CBP employees with access to Microsoft 365, Adobe Acrobat, and Citrix, plus surveillance-specific tools. About 4,500 users, including ICE deportation officers, belonged to a 'Headspace_users' group tied to a since-expired therapy contract, over 2,000 HSI users had Penlink web surveillance access, and 200+ CBP users were linked to the Mobile Fortify facial-recognition app. Anyone researching government surveillance tech stacks can keep up with disclosures like this on daily.dev."}}]} ```