Hackers claim leak of sensitive details on thousands of DHS workers

DHS Investigates Claimed Exposure of Employee Data

Activelifezero.com – The Department of Homeland Security is examining a possible cybersecurity breach after hackers said they obtained and released sensitive information connected to tens of thousands of present and former employees. The material may include details involving personnel assigned to covert operations and other high-security work, raising concerns about the safety of employees and the integrity of ongoing investigations.

A DHS spokesperson said the department knew of the potential incident and was moving quickly to respond.

“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected.”

A person familiar with the breach confirmed that information tied to some undercover personnel had been disclosed. Even when a data release does not reveal classified operational material, personal records can create substantial risks by helping hostile actors identify, contact, impersonate, harass, or track government workers.

Data Included Contact and Assignment Details

The hacktivist group calling itself the Department of Peace claimed responsibility for obtaining the records. Distributed Denial of Secrets, an anti-secrecy organization, placed the material online Wednesday and said the data came from an internal DHS database connected to an employee single sign-on system.

Emma Best, co-founder of Distributed Denial of Secrets, said the release identifies people involved in shaping and carrying out DHS policy and operations. A preliminary examination found that at least some personal details assigned to DHS staff members were accurate.

The released files include telephone numbers, reporting relationships and job assignments. The data also contains records connected to at least three Immigration and Customs Enforcement officers and Border Patrol officers involved in shootings during the second Trump administration.

For affected workers, the immediate danger may not be limited to the initial publication of their information. Phone numbers, names, supervisors and workplace roles can be combined with publicly available material to make phishing attempts more convincing. Such information can also support doxxing campaigns, where private details are spread online to encourage intimidation or harassment.

Employees Told Agency Is Assessing Threats

DHS reminded its workforce Thursday that it was aware of the claimed breach. An internal message told employees that the department was working to define the scale of the problem, evaluate possible threats and determine what protective resources might be needed.

An earlier employee notice directed personnel to existing resources meant to help remove personally identifiable information from public internet sources. Those tools can be important after a breach, although they cannot necessarily eliminate information that has already been copied or reposted elsewhere.

Officials familiar with the data release expressed both concern and a sense that federal agencies have faced similar episodes before. One official described the situation as embarrassing while saying more damaging breaches have occurred. The potential for targeted scams and personal exposure remained a central worry.

Federal agencies depend on large workforces that include investigators, border personnel, analysts, administrative employees and contractors. A breach affecting such a broad population can have different consequences for different people. Workers involved in sensitive cases, enforcement activity or undercover assignments may face heightened personal and professional risks if their identities or contact information become widely available.

Calls for a Deeper Review

Thomas Warrick, a former DHS deputy assistant secretary for counterterrorism policy, said the release could help attackers direct malicious activity toward the computers and devices of personnel handling security work and sensitive investigations. He urged Congress to conduct a comprehensive review of how the intrusion happened.

“DHS can’t just lock the barn door after the horse was stolen. It needs to make sure DHS and its contractors focus more on keeping the barn locked.”

The reference to contractors is significant because modern federal technology systems often rely on a mix of agency-managed networks, outside vendors and shared identity services. Investigators will need to determine what systems were accessed, whether the information was current, how broadly it circulated and whether any additional protective measures are necessary for affected personnel.

Sarah Pierce, director of social policy at the Third Way think tank and a former official at DHS’s US Citizenship and Immigration Services agency, stressed that many people whose data may have been exposed are career civil servants rather than policymakers.

“This hack has just served to put thousands of ordinary civil servants in the crosshairs of anonymous internet trolls.”

“Many of these employees have served the federal government for decades, under multiple administrations. They didn’t design these policies, and they don’t deserve to be punished for them.”

Part of a Wider Problem for Federal Law Enforcement

The alleged DHS incident follows another major claimed release of federal personnel information. Last month, the FBI confronted what was described as its most serious breach in years after the cybercriminal group ShinyHunters said it had accessed records involving thousands of current and former FBI employees.

That earlier data theft included information related to FBI staff serving in sensitive units focused on China and Russia. Together, the incidents illustrate the expanding challenge government agencies face when staff records are targeted by groups seeking publicity, political influence, financial gain or the ability to disrupt operations.

For DHS, the investigation will likely focus on containment, verification of the data, notification of potentially affected workers and efforts to reduce the chance that exposed details can be weaponized. The department has not publicly described the full scope of the suspected breach, and the safety implications may depend on which records were accessed and how much of the information proves authentic.