IC Oversight & Policy — 2026-10-30

DHS Leak Exposes Contact Information on Intelligence and Analysis Personnel

BLUFExposed names, phone numbers, and roles of roughly 75 Office of Intelligence and Analysis personnel create immediate targeting vectors for foreign intelligence services and criminals, demanding urgent counterintelligence mitigation regardless of how the data was obtained.

Distributed Denial of Secrets (DDoSecrets) published searchable records on more than 41,000 current and former DHS employees and contractors on Wednesday, saying a hacktivist group calling itself the Department of Peace supplied them 12. The data includes names, phone numbers, email addresses, job titles and group memberships across ICE, CBP, CISA and other components, and Nextgov/FCW corroborated portions through phone and LinkedIn checks 1. Nextgov/FCW found about 75 records tied to the Office of Intelligence and Analysis, and reached two listed officials by phone, one of whom appeared to acknowledge the number 3. The group claimed it took the data from DHS's Okta single sign-on service, which Okta denies was compromised, and DHS said it is "aware of a potential breach" 12.

Analysis
I have high confidence in this assessment, because Okta flatly denies a compromise, DHS concedes only "a potential breach," and nothing independently verifies the group's claim that the data came from Okta. It is unlikely that DHS or Okta publicly confirms by November 20 that the leaked employee records originated from a compromise of a DHS or Okta system. The exposure matters more than its origin. Roughly 75 records tie Office of Intelligence and Analysis staff to names, numbers and roles that foreign services or criminals can exploit for targeted approaches, so I&A and DHS counterintelligence should treat listed personnel as open to impersonation and phishing now, whatever forensics later show. The records may instead have come from a contractor, a third-party vendor or an earlier breach, as the group's claimed March hack of a DHS contractor suggests, which would make Okta's denial accurate. Sourcing is broad on the release itself but rests on the hackers' word for the access path. Without confirmation, the response stays on credential resets and notifications rather than identity-system remediation or audits of Okta-dependent agencies.

4 sources

DHS personnel leak exposes contact details and sensitive job information - Nextgov/FCW
U.S. DHS officials' details apparently exposed in massive data breach - CNBC
DHS leak exposes contact information on intelligence personnel - Nextgov/FCW
Website leaks data on more than 40,000 DHS employees - The Hill