DHS leak exposes contact information on intelligence personnel

Contact information and organizational affiliations for personnel in the Department of Homeland Security’s Office of Intelligence and Analysis have been exposed in a leak of some 41,000 agency records published Wednesday.

Nextgov/FCW called numbers listed in the data for two I&A officials. One call reached a voicemail greeting identifying the official by name. The second person answered and offered little comment, but appeared to acknowledge that the listed number was theirs. Nextgov/FCW is withholding both officials’ names and positions.

The findings confirm the leak extends partly to the Homeland Security Department’s main intelligence arm, whose work includes counterterrorism, cyber threat analysis and transnational organized crime⁠. I&A is a member of the U.S. intelligence community and connects federal intelligence with information from state and local authorities and private-sector partners. 

The entire scope of the exposure within I&A remains unclear, though around 75 records viewed by Nextgov/FCW appeared to tie personnel to the office. Both I&A field operations and headquarters staff are listed in the data.

The broader collection — which includes personnel in Immigration and Customs Enforcement, Homeland Security Investigations, the Cybersecurity and Infrastructure Security Agency and a slew of other department components — was published by transparency nonprofit Distributed Denial of Secrets. 

Famed Swiss hacker and journalist known as “maia arson crimew” also said she was involved in working through the data, which was provided by a hacktivist group calling itself the Department of Peace.

The data includes names, phone numbers, email addresses, job titles and internal group memberships across the department. Some entries are historical, including records associated with former employees, Nextgov/FCW confirmed Wednesday.

Exposed contact details could help foreign intelligence services or criminals identify intelligence personnel and approach them with messages or calls designed to appear legitimate.

The leak is a potentially “severe operational failure” that puts safety of undercover personnel at risk, said Dray Agha, a senior tactical response manager at cybersecurity firm Huntress. “Exfiltrating this directory data gives hostile actors a complete map of sensitive departments and their internal reporting structures.” 

The Department of Peace described the breach as retaliation for Secretary Markwayne Mullin’s pledge to intensify immigration enforcement. The publishers said the release could support public records requests and scrutiny of DHS operations. 

“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a department spokesperson said. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.” 

The group claimed it obtained the records through an Okta single sign-on service used by DHS, which allows employees to access multiple workplace applications through one login. Nextgov/FCW has not directly confirmed that account. An Okta spokesperson previously said the company is secure and hasn’t seen evidence of compromise. 

“The​ ​danger​ ​here​ ​goes​ ​well​ ​beyond​ ​a​ ​list​ ​of​ ​names.​ ​Connecting​ ​someone’s​ ​identity​ ​to​ ​their​ ​job,​ ​contact​​ information​ ​and​ ​operational​ ​role​ ​gives​ ​an​ ​adversary​ ​a​ ​targeting​ ​map,” said Alissa Knight, the CEO of Assail’s federal government arm. “It​ ​can​ ​make​ ​impersonation​ ​more​ ​convincing,​ ​expose​ ​sensitive​ ​personnel​ ​and​ ​create​ ​risks​ ​that​ ​extend​ ​beyond​ ​the​ ​network.”

The exposure comes during a period of upheaval for I&A over the last year. Nextgov/FCW previously reported⁠ that the office underwent substantial workforce reductions in 2025, following a more sweeping downsizing plan that was paused after objections from law enforcement and other organizations that rely on its threat reporting. 

DHS has also faced scrutiny over its ability to detect intrusions. Earlier this year, personnel twice dismissed signs of hackers inside the Homeland Security Information Network before confirming a breach, Nextgov/FCW first reported.

The incident also follows a separate but similar disclosure of FBI employee information involving intelligence and surveillance personnel⁠. That incident, claimed by prolific criminal hacking group ShinyHunters, exposed details that could help outsiders identify employees whose work is not widely known and tailor efforts to deceive or threaten them.