Federal Data Breach: Hacker Leaks Personnel Records of Thousands of Homeland Security Agents

Personally identifiable information belonging to thousands of U.S. Department of Homeland Security employees was published online following an earlier security breach, according to public records leaks. The exposed dataset contains full names, job titles, direct work email addresses, mobile phone numbers, and office locations for more than 40,000 personnel. Affected personnel work across multiple critical federal agencies, including border control, immigration enforcement, cyber defense, and executive leadership divisions.

A hacker using the handle Department of Paws obtained the personnel data by exploiting an Okta single sign-on portal used by Homeland Security. The portal allows federal employees and contractors across various agencies to log into internal workplace systems. Beyond basic contact details, the compromised Okta system records contained user account permissions and log-in details that reveal which software tools, internal databases, and web services specific employees have access to.

More than half of the records belong to roughly 21,000 employees working for U.S. Customs and Border Protection, including field agents stationed along border regions, maritime ports, and international entry points. The leaked files also contain active records for another 10,000 employees at U.S. Immigration and Customs Enforcement, including Homeland Security Investigations special agents. Additionally, the leak exposed records for roughly 1,000 employees at the Cybersecurity and Infrastructure Security Agency, alongside personnel at U.S. Citizenship and Immigration Services and the Federal Protective Service.

The hacker shared the stolen security database with non-profit leak repository Distributed Denial of Secrets, which published the records online in the public interest. Security researchers who reviewed the files confirmed that the dataset contains thousands of unique personnel entries. The total number of leaked records accounts for roughly one-fifth of the entire Department of Homeland Security workforce, which maintains around 220,000 active employees.

Beyond basic contact info, the leaked records shed light on the specific software applications used by federal agents during daily investigations. Log-in entries show that over 4,500 active users, including ICE agents and deportation officers, maintained account permissions for online therapy platform Headspace, which held a major federal contract with the department. The dataset also revealed user access groups for specialized web surveillance platforms, including PenLink software used for mobile tracking, MobileServ tools used for identity verification, and custom ChatGPT integrations.

Department of Homeland Security representatives stated that officials are reviewing the incident and working to address security gaps. Meanwhile, privacy advocates and public interest groups noted that exposed government records can help journalists, legal teams, and civil rights groups identify active law enforcement personnel and verify public records requests. However, exposed phone numbers and direct email addresses also raise personal safety concerns for field agents, making system patch updates an immediate priority for federal IT security teams.

The incident highlights how vulnerable central authentication portals remain when security controls fail. When a single sign-on system gets compromised, attackers gain access to sensitive employee directories and internal software inventories instantly. Securing single sign-on portals, enforcing multi-factor authentication, and auditing user access logs are necessary steps to protect government networks from future data leaks.