Hacktivists Leak Data on Over 41,000 DHS Employees After Okta Breach Claim
Hacktivists claiming to be the 'Department of Peace' have leaked data on more than 41,000 Department of Homeland Security employees and contractors, alleging a breach of an Okta single sign-on service.
A hacktivist group calling itself the 'Department of Peace' has claimed responsibility for a significant data leak impacting over 41,000 Department of Homeland Security (DHS) employees and contractors. The group alleges that the breach originated from an Okta single sign-on service used by the agency. The leaked data, which includes internal information and personnel details, has been published on a leak site and obtained by the transparency nonprofit Distributed Denial of Secrets (DDoSecrets) and hacker maia arson crimew.
Emma Best, founder of DDoSecrets, described the leak as "extraordinary but deceptive in its simplicity." She highlighted that the dataset identifies officials responsible for overseeing covert operations, investigations into leakers, and the "failed BlueLeaks investigation," as well as key personnel involved in DHS's rendition and deportation programs. Researchers have verified the inclusion of data pertaining to current employees of the Cybersecurity and Infrastructure Security Agency (CISA), along with some former leadership members who departed the agency years ago. The data spans several years, with some entries referencing internal planning related to COVID-19 and internal summits held in 2023.
The hacktivists stated that this breach is a direct response to DHS Secretary Markwayne Mullin's public promise of "stepped-up operations." A spokesperson for the Department of Peace commented, "On July 17th, Markwayne Mullin said he was 'turning up the heat.' This is what happens to ICE when you do that." The group asserts they obtained the database through a compromise of an Okta single sign-on service utilized by DHS.
Okta has responded to the reports, stating, "Okta is secure, and we have no evidence our data or systems were compromised." DHS had not immediately responded to requests for comment at the time of reporting. Maia arson crimew, a Swiss hacker and journalist who created a search tool for the leaked DHS data, emphasized its scale and potential impact. "It provides an unprecedented look into the Department of Homeland Security’s organizational structure, highlighting which people do what work across multiple DHS agencies, including ICE," crimew stated.
Security researchers believe the leaked data could be highly valuable for Freedom of Information Act (FOIA) requests. Ryan Shapiro, executive director of Property of the People, noted that "Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results." He added that "Given the Trump administration’s contempt for even basic transparency, the need for such tools is urgent."
DHS has a history of experiencing significant data breaches. In 2014, a breach potentially exposed the data of 390,000 current and former employees, job applicants, and contractors. More recently, in 2018, DHS notified nearly 250,000 individuals about a separate breach. Earlier in 2026, security firm GitGuardian discovered a public GitHub repository that exposed credentials for privileged AWS GovCloud accounts and internal CISA systems dating back to November 2025, indicating ongoing vulnerabilities.
The "Department of Peace" hacktivist collective appears to be a new entity or a rebranding of existing groups, leveraging the narrative of peace and transparency to justify their actions. Their stated motivation, a response to perceived aggressive government actions, aligns with a broader trend of hacktivism targeting government agencies. The use of an Okta SSO service as the alleged entry point highlights the critical importance of securing identity and access management systems, which often serve as the gateway to vast amounts of sensitive data across an organization.