Late in the evening on October 28, a hacker group operating under the name "Department of Peace" publicly released a database containing information on more than 41,000 officials of the US Department of Homeland Security (DHS). The publication was hosted on the Distributed Denial of Secrets website, a non-profit organization specializing in the distribution of data leaks. According to CNBC, the database features employees of Immigration and Customs Enforcement (ICE) and the Border Patrol. It includes officials' names, their departments and job titles, personal phone numbers, email addresses, and information about their direct supervisors. Access to the database is organized via a search bar, allowing users to find specific records by name or position.
Dispute over the mechanism: hackers blame Okta, company denies breach
A key element of the incident is the attackers' version of how they gained access to the ministry's corporate data. According to the "Department of Peace," the leak was made possible through Okta's single sign-on service, which DHS uses. However, Okta stated that its systems are secure and they have found no evidence of a breach. Thus, the question of the actual mechanism of data compromise remains open and unconfirmed by independent technical investigations.
Washington's reaction: DHS acknowledges "potential leak"
The Department of Homeland Security confirmed to The Washington Post that the agency is aware of a potential leak and is actively looking into the situation. At the same time, the official comment does not contain an admission of the compromise of specific data or an assessment of their scale — the phrasing "potential leak" indicates that DHS was still verifying the information at the time of the statement. This creates a gap between the hackers' public statement about a ready-made database and the ministry's own cautious stance.
Political context: response to the DHS chief's statement
The hackers explained their action with motivation related to migration policy. According to them, the attack was a response to a statement by DHS head Markwayne Mullin who, as the attackers claim, promised on July 17 that ICE would "step up pressure on the streets" by increasing the number of migrant arrests and roadside checks. Thus, the group positions the leak as a tool of pressure on the agency in the context of its migration policy.
Background: ICE intensification in Trump's second term and lawsuits
The incident occurs against the backdrop of a sharp increase in arrests and deportations by the immigration service during the second term of President Donald Trump. This policy has sparked a wave of criticism: ICE agents have repeatedly been caught on video using force against individuals. The harsher course has also affected foreigners legally residing in the US. In August, labor unions and human rights organizations challenged new visa validity rules for foreign students, scholars, and journalists in court, believing the changes will create serious problems for universities, students, and the media; plaintiffs are asking a Massachusetts court to block these rules.
Significance of the incident
The leak, even to the extent confirmed so far, poses a significant risk: the publication of personal contacts and the subordination structure of tens of thousands of law enforcement and immigration personnel can be used for targeted threats, blackmail, or social engineering. While neither DHS nor Okta has provided a complete technical picture, and independent verification of the database's content and authenticity remains limited, the incident should be viewed as a confirmed fact of data publication on a third-party resource with reservations regarding the scale and mechanism of the leak.
