🚨Hacker Steals 40,000 DHS Employee Records, Leaks Them to DDoSecrets

Your federal contacts just leaked, and Okta is in the blast radius

A hacker grabbed contact details and login records for more than 40,000 Homeland Security employees, and the data is now floating around on DDoSecrets. That's roughly one-fifth of the department's workforce, gone in one dump. If you work in federal IT or security, this one hits close to home. The leak includes Active Directory group memberships, which tells an attacker who can reach what. Around 4,500 users sit in a group called Headspace_users, and one group references Penlink PLX, a tool for capturing real-time intelligence from calls, texts, and web activity. Anyone building internal tooling on Microsoft 365 should assume the map of access is now public. More than half the records belong to U.S. Customs and Border Protection staff. ICE and its HSI unit account for much of the rest, with one HSI group exceeding 2,000 users nationally. TechCrunch verified part of the data by matching known employee names against an offline copy. The records appear to have been pulled around mid-August. It's unclear whether the vulnerability has been patched, or whether DHS even knows about the theft yet. Okta said it's aware of the report and has seen no evidence of compromise on its side.