Leak site publishes directory data on more than 41,000 DHS employees, and the claim that Okta was the source is unverified
October 28, 2026 (October 28, 2026)
On October 28 the nonprofit Distributed Denial of Secrets (DDoSecrets) published internal records on more than 41,000 Department of Homeland Security employees and contractors that it received from a hacktivist group calling itself the Department of Peace. The data includes names, phone numbers, email addresses, job titles and email or permission groups, which in some cases show who works on sensitive assignments. The group says it took the data from an Okta single sign-on service used at DHS and describes the leak as a protest against stepped-up immigration enforcement. Okta says it has no evidence its data or systems were compromised, and DHS had not commented when CyberScoop and Reuters reported. CyberScoop confirmed that many current CISA employees appear in the data, and Reuters matched details of six named employees to other records and confirmed others by phone. How the data was taken has not been established.
Why it matters
A staff directory with group memberships is a map of who holds which role and access, which helps phishing and targeting. A vendor's denial and an attacker's claim are both unverified until the customer's own logs show what happened.
What defenders can take from it
- Review your single sign-on administrator accounts, API tokens and service accounts, and remove ones that are unused.
- Check identity-provider logs for bulk directory or group exports and new admin sessions over the past 90 days.
- Plan for a staff roster leaking: who tells employees, and what protection staff in sensitive roles receive.