An unprecedented breach of federal personnel records has triggered a major operational security crisis across the U.S. Department of Homeland Security. A hacktivist entity calling itself the Department of Peace has published sensitive organizational data and personal identifiers covering more than 41,000 DHS employees and contractors.
The archive, published and distributed online via the transparency collective Distributed Denial of Secrets, known as DDoSecrets, on October 28, 2026, spans personnel across DHS headquarters and seven sub-agencies. The leak is heavily weighted toward immigration enforcement arms: U.S. Customs and Border Protection (CBP) accounts for over 21,000 entries, while Immigration and Customs Enforcement (ICE) accounts for roughly 6,600 to 10,000 records.
What the archive contains | Names, units, and undercover telemetry
DHS Leaked Personnel Archive (October 2026)
| Total Exposed Records | More than 41,000 employees and contractors |
| Primary Affected Units | CBP (21,000+), ICE (6,600 to 10,000), USCIS (about 6,200), CISA |
| Data Fields Leaked | Names, work emails, phone numbers, office locations, org charts |
| Operational Telemetry | Over 55,000 internal permission-group names |
| Host Provider | FlokiNET, an Icelandic offshore privacy host |
Beyond basic contact details, cybersecurity researchers at WIRED and Ars Technica found the archive exposes over 55,000 internal permission-group names. Those group labels map out internal organizational structure and reveal non-public details about certified undercover operations, wiretap units, communications-intercept teams, and specific surveillance platforms including Palantir's Falcon and PenLink.
That distinction matters. A leaked work email is an inconvenience. A leaked permission-group name labeled as a wiretap unit tells an adversary which teams exist, who sits inside them, and what they were working on.
Threat spike | Agents named and tracked online
According to a threat analysis by the SITE Intelligence Group reported by The Washington Post, the release immediately fueled violent rhetoric across radical online channels. Extremist groups and anti-deportation networks are actively using the leaked directory to target individual field agents, publish home addresses, and advocate direct physical retaliation against officers participating in active enforcement operations.
Threat Pipeline and Data Misuse
The takedown standoff | DHS demands, FlokiNET refuses
To mitigate risks to active field agents, DHS deployed third-party vendor ZeroFox to issue urgent takedown demands to the site's host. The effort hit a wall in Europe.
The Icelandic privacy-focused hosting company FlokiNET formally declined to take the database offline. FlokiNET's chief executive defended the hosting, arguing that the files contain government work contact details rather than private residential addresses or Social Security numbers. That framing sits at the center of the dispute: DHS treats the roster as an operational security threat because of the unit structures it exposes, while the host treats the content as workplace directory data that does not meet its takedown threshold.
The refusal is not academic. A dataset that stays online gets scraped, mirrored, and indexed. Although the archive was briefly taken offline on October 29 following domain-level interventions, the searchable database was quickly mirrored across secondary offshore domains, which is the practical end of any single-host takedown strategy.
How the data was taken | The Okta dispute
The Department of Peace claimed it harvested the database by compromising single sign-on workflows through identity provider Okta. Okta forcefully rejected the claim, confirming its core systems show zero evidence of compromise.
Unresolved attribution is common in these cases, and the gap between the group's claim and the vendor's denial leaves DHS auditing internal access logs to pinpoint how the directory was originally exfiltrated. Two explanations remain live: an upstream identity compromise, or legitimate credentials obtained through infostealer malware and used without any provider-side breach at all.
The second scenario matches a pattern OnyxTimes has covered repeatedly. Ransomware crew BYOD reached Trump Mobile not through its own web assets but by infecting an employee at a partner network operator, and North Korean operatives have built entire careers on stolen American identities. Credential abuse keeps beating perimeter defense because it never needs to break anything.
Third federal exposure in 30 days
The breach marks the third major federal government data exposure within a 30-day window, heightening friction between federal law enforcement and digital hacktivist networks. Federal personnel are already navigating an environment where the Justice Department has subpoenaed reporters over government data leaks, and disclosure disputes are landing in court rather than in incident reports.
With ICE and CBP operating under elevated threat protocols, field personnel have been instructed to harden personal social media accounts, monitor personal phone lines for harassment, and report any unauthorized physical surveillance near field offices. The guidance is a recognition that the exposure cannot be recalled, only defended against going forward.
For readers tracking how much identifiable data already circulates about individuals, our breakdown of the 515-page McDonald's CCPA dossier shows the same structural problem in commercial form: once a dataset is assembled, controlling where it goes stops being the holder's decision.
Verifiable Sources & Further Reading