---
title: "\"Department of Peace\" leaks data of 41,000 US DHS employees: from ICE to border patrol"
description: "The \"Department of Peace\" hackers published a database of over 41,000 US DHS employees, including ICE and border patrol, on Distributed Denial of Secrets. Okta denies a breach, while DHS acknowledges a \"potential leak\"."
date: 2026-10-30T03:53:05.438Z
lang: en
url: https://xab.info/en/posts/department-of-peace-dhs-data-leak-ice
tags: [data-breach, dhs, ice, cybersecurity, okta, us-immigration]
author: "Alexander Buran"
publisher: "XAB.info"
---

# "Department of Peace" leaks data of 41,000 US DHS employees: from ICE to border patrol

![Hacker in the dark working on a laptop and connecting a smartphone via cable](https://xab.info/media/2026/10/30/department-of-peace-dhs-data-leak-ice/department-of-peace-dhs-data-leak-ice-1.webp)

## Key Points

- The "Department of Peace" group published a database of over 41,000 US DHS officials, including ICE and border patrol personnel, on the Distributed Denial of Secrets website on October 28.
- According to CNBC, the database contains names, departments, titles, phone numbers, email addresses, and direct supervisor info, accessible via search.
- Hackers claim data was obtained via Okta's single sign-on service; the company stated its systems are secure and there is no evidence of a breach.
- DHS confirmed to The Washington Post that it is aware of a potential leak and is working on the situation.
- The attack was framed as a response to DHS chief Markwayne Mullin's July 17 statement on increasing ICE "pressure on the streets".

Late in the evening on October 28, a hacker group operating under the name "Department of Peace" publicly released a database containing information on more than 41,000 officials of the US Department of Homeland Security (DHS). The publication was hosted on the Distributed Denial of Secrets website, a non-profit organization specializing in the distribution of data leaks. According to CNBC, the database features employees of Immigration and Customs Enforcement (ICE) and the Border Patrol. It includes officials' names, their departments and job titles, personal phone numbers, email addresses, and information about their direct supervisors. Access to the database is organized via a search bar, allowing users to find specific records by name or position.

### Dispute over the mechanism: hackers blame Okta, company denies breach

A key element of the incident is the attackers' version of how they gained access to the ministry's corporate data. According to the "Department of Peace," the leak was made possible through Okta's single sign-on service, which DHS uses. However, Okta stated that its systems are secure and they have found no evidence of a breach. Thus, the question of the actual mechanism of data compromise remains open and unconfirmed by independent technical investigations.

### Washington's reaction: DHS acknowledges "potential leak"

The Department of Homeland Security confirmed to The Washington Post that the agency is aware of a potential leak and is actively looking into the situation. At the same time, the official comment does not contain an admission of the compromise of specific data or an assessment of their scale — the phrasing "potential leak" indicates that DHS was still verifying the information at the time of the statement. This creates a gap between the hackers' public statement about a ready-made database and the ministry's own cautious stance.

### Political context: response to the DHS chief's statement

The hackers explained their action with motivation related to migration policy. According to them, the attack was a response to a statement by DHS head Markwayne Mullin who, as the attackers claim, promised on July 17 that ICE would "step up pressure on the streets" by increasing the number of migrant arrests and roadside checks. Thus, the group positions the leak as a tool of pressure on the agency in the context of its migration policy.

### Background: ICE intensification in Trump's second term and lawsuits

The incident occurs against the backdrop of a sharp increase in arrests and deportations by the immigration service during the second term of President Donald Trump. This policy has sparked a wave of criticism: ICE agents have repeatedly been caught on video using force against individuals. The harsher course has also affected foreigners legally residing in the US. In August, labor unions and human rights organizations challenged new visa validity rules for foreign students, scholars, and journalists in court, believing the changes will create serious problems for universities, students, and the media; plaintiffs are asking a Massachusetts court to block these rules.

### Significance of the incident

The leak, even to the extent confirmed so far, poses a significant risk: the publication of personal contacts and the subordination structure of tens of thousands of law enforcement and immigration personnel can be used for targeted threats, blackmail, or social engineering. While neither DHS nor Okta has provided a complete technical picture, and independent verification of the database's content and authenticity remains limited, the incident should be viewed as a confirmed fact of data publication on a third-party resource with reservations regarding the scale and mechanism of the leak.

## Accounts differ

### Data acquisition mechanism

- **"Department of Peace" hacker group:** Data was obtained through Okta's single sign-on service used by the ministry ([rbc.ua](https://www.rbc.ua/ukr/news/hakeri-zlili-dani-ponad-41-tisyachi-spivrobitnikiv-1793332045.html))
- **Okta company:** The company's systems are secure, there is no evidence of a breach ([rbc.ua](https://www.rbc.ua/ukr/news/hakeri-zlili-dani-ponad-41-tisyachi-spivrobitnikiv-1793332045.html))

*Where they agree:* The DHS employee database was publicly published on the Distributed Denial of Secrets website

## Fact-Check & Sources

- [Хакеры слили данные более 41 тысяч сотрудников Министерства внутренней безопасности США](https://www.rbc.ua/ukr/news/hakeri-zlili-dani-ponad-41-tisyachi-spivrobitnikiv-1793332045.html) - Primary source; fully matches the basis: 41+ thousand DHS employees, October 28 publication on DDoS, database composition per CNBC, Okta's version, DHS response (WaPo), motivation via Mullin's statement, context of Trump's second term and the Massachusetts lawsuit.
- [Сайт "АТБ" взломан: хакеры утверждают, что получили доступ к данным клиентов и сотрудников](https://www.dialog.ua/ukraine/sayt-atb-vzloman-khakery-utverzhdayut-chto-poluchili-dostup-k-dannym.html) - Подтверждено по источнику dialog.ua
- [Хакеры слили в сеть личные данные силовиков Израиля](https://mignews.com/news/disasters/hakery-slili-v-set-lichnye-dannye-silovikov-izrailya.html) - Подтверждено по источнику mignews.com
- [ФБР не может установить масштаб утечки: похищены данные десятков тысяч агентов](https://argumenti.ru/society/fbr-ne-mozhet-ustanovit-masshtab-utechki-pohishheny-dannye-desyatkov-tysyach-1010370) - The source describes an incident involving ShinyHunters and the FBI, which is not identical to the "Department of Peace" group and DHS stated in the basis; it is not used as direct confirmation of this news.

## FAQ

### What exactly was published in the leak?

According to CNBC, the database on the Distributed Denial of Secrets website contains the names of over 41,000 DHS officials, their departments, titles, phone numbers, email addresses, and direct supervisor details, accessible via a search function.

### Who is behind the publication and when did it appear?

The database was published late in the evening on October 28 by a hacker group operating under the name "Department of Peace" on the website of the non-profit organization Distributed Denial of Secrets.

### Did the US Department of Homeland Security confirm the leak?

DHS confirmed to The Washington Post that it is aware of a potential leak and is proactively addressing the situation; however, the agency did not explicitly acknowledge the fact and scale of specific data compromise.

### What does Okta say about the breach?

Okta stated that its systems are secure and there is no evidence of a breach, whereas the hackers claim they obtained the data specifically through Okta's single sign-on service.