Personnel data for more than 40,000 US Department of Homeland Security employees has been published online, after a previously undisclosed breach earlier in 2026. TechCrunch reported the publication on 28 October 2026, after verifying a portion of the data by matching the names of several known DHS employees against an offline copy of the database. A DHS spokesperson did not immediately respond to TechCrunch’s request for comment, and the way in remains disputed.
The employee directory records appear to have been exfiltrated around mid-August 2026, according to timestamps on each person’s record. That puts roughly 10 weeks between the apparent theft and its first public report, during which, per TechCrunch, the breach was previously undisclosed and it remains unclear whether DHS knew about the theft at all.
Who is in the dataset
TechCrunch puts the dataset at more than 40,000 people, including border and immigration agents, cybersecurity staffers, and senior department officials. The agency split, as reported, is:
- US Customs and Border Protection (CBP): some 21,000 records, more than half the dataset.
- Immigration and Customs Enforcement (ICE) and Homeland Security Investigations (HSI): 10,000 records.
- Cybersecurity and Infrastructure Security Agency (CISA): just under 1,000 records.
- DHS headquarters, US Citizenship and Immigration Services (USCIS), the Federal Protective Service, and other agencies: thousands of additional records.
TechReview’s own calculation from TechCrunch’s figures: at a 40,000 baseline, CBP accounts for about 52.5% of the dataset, ICE and HSI for 25%, and CISA for under 2.5%, leaving at least about 8,000 records, around 20%, for headquarters and the other agencies. Because TechCrunch says “more than 40,000”, these shares are upper bounds; the true shares are lower if the total is higher. The same arithmetic checks TechCrunch’s framing: 40,000 out of a workforce of around 220,000 is 18.2%, matching its “about one-fifth” description.
What was exposed, and what was not
The exposed data, per TechCrunch, is work contact information and internal access records: names, job titles, work email addresses, cell phone numbers, and office locations, plus IT and login records showing which systems and internal apps each employee is permitted to access. The dataset also contains employees’ membership in user groups within DHS’s Active Directory, which controls access to internal tools, services, and third-party offerings used for work.
What TechCrunch does not claim matters just as much. Social Security numbers, home addresses, passwords, and financial data are not listed in this report. Readers should not assume those were taken, because no source in this story says so.
The stolen data was provided to journalist and hacker maia arson crimew, who then shared a copy with DDoSecrets, a nonprofit collective that hosts leaked datasets in the public interest. TechCrunch describes the latest batch of breached data as appearing authentic, not as fully verified record by record.
What is still disputed
The entry point is a claim, not an established fact. A hacker using the handle “Department of Peace” claimed the data came from an Okta single sign-on system used by DHS to let employees and contractors across its agencies log into its central network. Okta disputes that account. When reached by TechCrunch, Okta said it was aware of the report and stated: “Okta is secure, and we have no evidence our data or systems were compromised.” The hacker did not answer TechCrunch’s questions about how the breach was carried out.
Two questions remain explicitly unanswered in TechCrunch’s report: whether the vulnerability that allowed the breach has been fixed, and whether DHS is aware of the data theft. A DHS spokesperson did not immediately respond to TechCrunch’s request for comment. A note left with the data, seen by TechCrunch, reads: “They have our information, so it’s only fair that we have theirs.” That is the wording of the note, not an independently verified motive.
Why the access map matters more than the headcount
The original reporting value in this dataset is not just 40,000 names. It is the map of who can access what. Most DHS employees in the dataset were members of the user group with access to Microsoft 365, as well as groups for Adobe Acrobat, Citrix, and other typical desktop software. Dozens of other groups reference Penlink, a web surveillance company; a Penlink spokesperson did not respond to TechCrunch’s request for comment. One group includes more than 200 CBP users associated with Mobile Fortify, a facial recognition app used by both CBP and ICE agents to identify people and verify their information and immigration status. The groups also include several employees associated with ChatGPT access, including senior DHS officials, and groups associated with investigations into the China-backed hacking groups known as Salt Typhoon and Volt Typhoon.
One number needs care. Around 4,500 users in this dataset, including ICE agents and deportation officers, are members of a group called “Headspace_users”. Headspace previously had an $82,500 federal contract with ICE that ended in 2023, and the company says it has not provided any services to DHS or ICE since 2023. That 4,500 is not the same as the separate January 2026 ICE List leak, in which about 4,500 ICE and Border Patrol agents’ personal data was allegedly exposed. Merging those two 4,500 figures would be wrong; they are different events with the same round number.
Two further non-connections apply. The March 2026 DHS contracts leak by the same hacker handle involved contracts with more than 6,000 companies, not personnel records, and is a separate dataset. TechCrunch’s mention of earlier FBI personnel theft and a Pentagon human resources breach is context only, not part of this story.
What to watch next
Three developments would change this story. First, a DHS statement confirming or disputing the breach, and saying whether affected employees have been notified. Second, any confirmation or denial from Okta or DHS about the claimed single sign-on entry point. Third, evidence about whether the vulnerability, if one exists, has been fixed. Until one of those arrives, the confirmed core stays narrow: a large personnel dataset was published, TechCrunch verified a portion of it, and the mechanism, the fix status, and DHS’s awareness remain unresolved.
Sources
- TechCrunch, Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents, 28 October 2026.
Note on sourcing: at the time of writing, no second tier-1 outlet had confirmed this breach; the only other hit found was an aggregator page mirroring the TechCrunch story, which is not independent confirmation and is therefore not cited as a source for any fact above.
