23 Daily — According to techcrunch.com, personally identifiable information (PII) of over 40,000 U.S. Department of Homeland Security (DHS) employees was stolen and published online following a previously undisclosed breach that occurred in mid-2026. The data breach reveals significant challenges in securing sensitive government data across multiple agencies.

Compromise affects multiple key Homeland Security agencies

The leaked data includes the names, job titles, and work contact information, such as emails, cell phone numbers, and office locations, related to around 40,000 individuals—approximately one-fifth of the DHS workforce of 220,000. Affected entities include about 21,000 employees from U.S. Customs and Border Protection (CBP), 10,000 from Immigration and Customs Enforcement (ICE) and Homeland Security Investigations (HSI), nearly 1,000 from the Cybersecurity and Infrastructure Security Agency (CISA), and thousands more from headquarters and other agencies like U.S. Citizenship and Immigration Services and the Federal Protective Service.

Data accessed via Okta single sign-on platform

The hacker, known as “Department of Peace,” claimed to have obtained the information through the Okta single sign-on system that DHS uses to authenticate employees and contractors across its agencies. This system also holds IT and login records detailing users' permitted access to internal systems and applications. Okta responded by affirming their service’s security and stating they have no evidence of a breach within their infrastructure.

Leaked information reveals extent of surveillance and internal tools usage

The stolen dataset contains user group membership data from DHS’s Active Directory system, which controls employee access to internal tools, services, and third-party software. Most employees had access to Microsoft 365, Adobe Acrobat, and Citrix. Notably, around 4,500 employees, including ICE agents, belonged to a group linked to the Headspace online therapy service, which previously held a contract with ICE until 2023. The data also reveals widespread use of Penlink, a surveillance software capable of tracking location data from millions of mobile devices and long used by ICE. Additionally, users of Mobile Fortify, a facial recognition app employed by CBP and ICE, were identified.

Editor's take: The breach underscores governmental cybersecurity gaps and surveillance risks

The incident exposes vulnerabilities in safeguarding sensitive employee data and highlights potential risks tied to the adoption of advanced surveillance technologies. For entrepreneurs, it signals opportunities in cybersecurity, identity management, and data protection services. Validation may include conducting penetration tests on similar systems, evaluating the security of single sign-on platforms, and enhancing employee cybersecurity training to develop robust solutions.