Emerging ThreatsData Breaches

Hacktivists Expose Data on 41,000 DHS Employees in Breach

Analyst 207||Source: CyberScoop
Government office setting with scattered papers and a blurred computer screen, hinting at a data breach, with an abstract…

"The leak is extraordinary but deceptive in [its] simplicity as it identifies the officials responsible for overseeing covert and undercover operations, the government’s hunt for leakers and the failed BlueLeaks investigation — along with key personnel in DHS’s ever-escalating rendition and deportation programs,” Emma Best, founder of Distributed Denial of Secrets, said Wednesday after a searchable dataset of Department of Homeland Security employees and contractors was published online.

What was published: more than 41,000 records across years

A leak website published internal data on more than 41,000 Department of Homeland Security employees and contractors, according to the reporting. The material, which DDoSecrets and the hacker maia arson crimew say they received from a hacktivist group calling itself the Department of Peace, spans multiple years and includes entries that reference COVID-19 planning and internal summits in 2023.

CyberScoop reported it was able to verify numerous current Cybersecurity and Infrastructure Agency employees are listed in the data, along with some former leadership members who left the agency years ago. The Swiss hacker and journalist maia arson crimew said the dataset “is massive in terms of both size and impact” and “provides an unprecedented look into the Department of Homeland Security’s organizational structure, highlighting which people do what work across multiple DHS agencies, including ICE.”

Who released the material and why: Department of Peace, DDoSecrets, and maia arson crimew

According to the published material and accompanying statements, Distributed Denial of Secrets and maia arson crimew obtained the data from the Department of Peace. A spokesperson for the Department of Peace framed the release as a reaction to policy signals from DHS leadership: “On July 17th, Markwayne Mullin said he was ’turning up the heat.’ This is what happens to ICE when you do that,” the spokesperson said, explicitly linking the leak to the promise of stepped-up operations from Immigrations and Customs Enforcement.

Crimew, who has previously been indicted in the United States over past leaks, also created a search tool intended to make the DHS data browsable and searchable, according to the reporting.

Alleged access path and vendor response: Okta and single sign-on

The Department of Peace said it obtained the dataset from an Okta single sign-on service used at DHS. Okta issued a statement that the company “is secure, and we have no evidence our data or systems were compromised.” DHS did not immediately respond to a request for comment, the reporting notes.

As of Thursday morning, the website hosting a searchable form of the data had been taken offline, an update added to the story at 9:30 a.m. on October 29, 2026.

What this means for CISA employees, ICE operations, and FOIA researchers

  • CISA employees: CyberScoop’s verification that numerous current Cybersecurity and Infrastructure Agency employees appear in the dataset suggests personnel listings and organizational mappings for CISA were included. Those entries may prompt internal reviews of what contact information and role details are publicly exposed.
  • ICE operations: Crimew and Department of Peace statements explicitly tie the release to Immigration and Customs Enforcement, and DDoSecrets framed parts of the dataset as identifying officials tied to rendition, deportation and undercover operations, signaling potential operational and privacy concerns for ICE staff named in the files.
  • FOIA researchers: Ryan Shapiro, executive director of Property of the People, said email addresses and phone numbers are “indispensable tools for FOIA researchers,” arguing that the dataset could materially change how records requests are drafted and pursued because such contact details “often make the difference between a vague records request that gets stonewalled and one that gets results.”

Prior DHS incidents and related exposures cited in the reporting

The story places the leak beside a string of previously reported DHS-related exposures. It cites a 2014 breach that may have exposed data for 390,000 then-current and former DHS employees, job applicants and contractors, and a 2018 notification to nearly 250,000 people about a breach at the department. The reporting also references a discovery earlier in 2026 by the security firm GitGuardian, which found a public GitHub repository exposing credentials for privileged AWS GovCloud accounts and internal CISA systems dating back to November 2025.

The published dataset and the reactions around it raise concrete, near-term questions about what personally identifiable information and operational mappings were included, how the data was accessed, and what safeguards — technical and procedural — DHS and its vendors will now invoke. With the searchable site taken offline, the immediate public exposure has been interrupted, but the public statements from DDoSecrets, crimew and the Department of Peace leave intact a record of what was claimed and the contours of the material released.

Read the original CyberScoop story: https://cyberscoop.com/dhs-employee-data-leak-ddosecrets/

Data BreachDepartment Of Homeland SecurityEmerging ThreatsHacktivismDHSEmployee Data ExposureDistributed Denial Of SecretsBlueleaksGovernment Data Leak
Related Intelligence

Continue Reading

Empty laptop screen on a clutter-free desk with soft natural light and blurred background decor.

Chrome Extensions Hijack 13.4M Users' Searches for Ad Revenue

A shocking 319 Chrome extensions, installed by 13.4 million users, have been secretly hijacking search queries to line their creators' pockets with ad revenue from major search engines like Bing and Yahoo. These sneaky extensions quietly took control of users' browsers, routing every search query through a proxy server to collect referral payments.

Analyst 207
Cluttered tech workbench with laptop, papers, and coffee cups, laptop screen showing abstract code.

Malware Exploits AI Apps to Deploy Crypto Miners

Malware operators are sneaking crypto miners into fake AI apps, like bogus desktop versions of Claude and ChatGPT, using clever tricks like a 12.73-day delay to evade detection. These malicious apps are being spread through fake GitHub projects and websites, hiding a crypto-mining payload in plain sight.

Analyst 207
A network operations center with computer workstations, servers, and a city view, with an empty laptop on a nearby table.

Malware Exploits OpenAI Keys for AI Queries

Malware has been discovered that exploits stolen OpenAI keys to secretly run AI queries, racking up bills for unsuspecting victims - with one variant capable of executing over 52 commands. This sneaky malware, detected by Cisco Talos, uses a Go-based implant to route requests through compromised machines.

Analyst 207
Modern Asian government building façade with subtle tech hints.

NetamLoader Exposes Sophisticated APT Attack on Asian Governments

Kaspersky analysts uncovered a highly sophisticated APT attack targeting Asian governments, using a custom .NET-based loader called NetamLoader to infiltrate a unique Windows 10 build. The attack began with a malicious CAB archive cleverly hidden in the Windows update cache, showcasing a cunning tactic to gain a foothold in high-security environments.

Analyst 207