A hacktivist group calling itself the Department of Peace says it took internal data on more than 41,000 US Department of Homeland Security employees and contractors from an Okta single sign-on service used at the department. A leak site published the data on Wednesday, and Okta says it has no evidence its own systems were compromised.
What the DHS Leak Contains and Who Published It
The data was passed to Distributed Denial of Secrets and to the hacker maia arson crimew, who obtained it from the Department of Peace. The set covers employees and contractors across DHS, including staff at ICE and CISA. A news outlet that reviewed the material verified numerous current CISA employees and some former leaders within it.
The records go back years. They include group names that refer to COVID-19 planning and to 2023 summits, which indicates the data reflects directory entries accumulated over time instead of a single snapshot.
DDoSecrets and crimew’s Search Tool
Emma Best of DDoSecrets says the data identifies officials who oversee covert operations, leak hunts and deportation programs. crimew built a search tool for the dataset, which makes it easier for the public to look up individuals.
The Department of Peace’s Stated Motive
The group says it took the database from an Okta single sign-on service. It links the action to DHS Secretary Markwayne Mullin’s July 17 promise of “turning up the heat” on ICE operations. The group presents the leak as a response to that policy.
Okta’s Denial and the Open Question of the Source
Okta says it is aware of the claims and has “no evidence our data or systems were compromised.” DHS had not responded when the story was reported. The two statements are not necessarily in conflict. Okta’s denial concerns its own platform, while the group’s claim concerns an SSO service used at DHS, which could be compromised through a customer-side weakness such as stolen credentials, an exposed tenant or access to the department’s own configuration.
How the group obtained the database has not been established. No evidence in the available reporting shows the method, the date of the intrusion, or whether the data came from Okta infrastructure or from a DHS environment that integrates with it.
Personal Safety and Counterintelligence Risks for Federal Staff
The exposure of more than 41,000 federal staff carries concerns that go beyond ordinary breach notification. Employee directories that name people involved in covert operations, leak investigations and deportation programs create risks to personal safety. Names and affiliations of cybersecurity staff at CISA also hand foreign intelligence services a ready-made list of targets for social engineering.
The analysis of identity-provider breaches generally holds that a directory’s value to an attacker lies in its structure. Group names and role assignments show who works with whom, which is information that phishing operators and intelligence services use to craft convincing approaches.
Because the dataset is already public and searchable, the harm cannot be recalled by a takedown. Whether DHS confirms the authenticity of the records, and whether it identifies the access path, will determine how the department responds and whether Okta’s position holds. Neither question had an answer at the time of publication.
The reference to Secretary Markwayne Mullin’s July 17 statement places the leak in a political context. The group says the release is a response to the promise of “turning up the heat” on ICE operations, and the data it published includes officials tied to deportation programs. That framing differs from financially motivated leaks, where the aim is sale or extortion, and it means the material was released openly instead of offered to buyers.
