Hackers dumped work details for tens of thousands of Homeland Security staff online, and the agency says it is investigating now.
Story Snapshot
- DHS confirmed awareness of a potential breach and a rapid response effort
- Reports cite more than 40,000 affected, with many from Border Patrol and ICE
- Leaked fields include names, work emails, phone numbers, and office locations
- Public posting raises safety and operational risks for frontline agents
A large leak hits core Homeland Security missions
The Department of Homeland Security said it is aware of a potential breach and is working to address it. That statement followed reports that more than 40,000 personnel records appeared online tied to multiple Homeland Security components. Tech outlets and major newsrooms described a dataset with names, job titles, work emails, phone numbers, and office locations. The reporting highlighted heavy exposure among Customs and Border Protection and Immigration and Customs Enforcement personnel, the frontline for border and immigration enforcement.
TechCrunch counted over 21,000 Customs and Border Protection-linked records and thousands more associated with Immigration and Customs Enforcement and Homeland Security Investigations, a major investigative arm within the department. Other outlets placed the total above 41,000, underscoring the scale of the exposure without perfect agreement on the final count. Uniformed Border Patrol agents, plainclothes investigators, and support staff all may face increased harassment risk when phone numbers and work locations go public.
What the data appears to show, and why that matters
Reports describe work-centric details that still carry real risk. A work cell number can be enough for targeted threats and social engineering. An office location can reveal patterns that put teams at risk when tensions run hot. One outlet said some entries referenced assignments tied to sensitive operations, including undercover work, which would heighten the stakes if accurate. Conservative common sense says government must shield those who enforce the law, not leave them exposed online to activists or criminals.
Some coverage framed the leak as a cause-driven “accountability” push by activists. That framing does not change the facts on the ground for agents whose names and numbers are now searchable. Public posting makes harassment easier and complicates recruitment and retention, especially in high-stress duty stations. It also hands scammers the raw material to trick colleagues or family members. Every successful social-engineering call can open a new door into government systems or personal lives.
How Homeland Security is expected to respond
Federal incident rules require fast reporting and scoping when a potential compromise surfaces. Agencies must identify what information was affected, estimate users and records, and flag any operational impact. That is why a public “potential breach” acknowledgment matters. It signals the playbook is live and law enforcement and security teams are moving to contain exposure, harden access, and support affected staff. The Cybersecurity and Infrastructure Security Agency guidance calls for quick isolation, log review, credential resets, and coordinated communications.
Homeland Security will likely prioritize three lanes at once. First, protect people: notify impacted employees, stand up hotlines, and coordinate with protective services. Second, protect systems: rotate credentials, add multifactor prompts, and tighten single sign-on sessions. Third, protect missions: scrub exposed duty details from public sites and adjust field operations where leaks could tip tactics. That is the basic order of work in federal playbooks and it matches the needs of border and investigative units that operate under threat.
Counting the damage without getting lost in the noise
Newsrooms do not agree on the exact totals, but they point to the same range: about forty thousand to just over forty-one thousand records. The Verge placed the figure above forty thousand, and the British Broadcasting Corporation used a similar range, which tracks with other outlets. The counts for Immigration and Customs Enforcement and Homeland Security Investigations vary because some sources combine investigative and parent-agency records while others split them. That detail matters for planning contact changes and duty safeguards, not for questioning the need to act.
🔥🚨 BREAKING: A Left-Wing hacking group broke into the U.S. Department of Homeland Security’s personnel files and exposed the names, phone numbers, and addresses of more than 40,000 DHS agents
The left-wing group calling itself the "Department of Peace" claimed they got in by… pic.twitter.com/r7QPeeCJvD
— The Patriot Oasis™ (@ThePatriotOasis) October 29, 2026
Public-facing safety steps can help right now. Managers should rotate exposed work numbers and emails for frontline staff and set up call-forwarding bridges so field agents do not miss mission traffic. Teams should rehearse short verification scripts so no one acts on a spoofed text or a rushed voicemail. Families should get basic guidance on handling strange calls or doorstep visits. None of this is dramatic. It is simple, real defense that treats agents as people, not usernames in a database.
Sources:
kpbs.org, techcrunch.com, bbc.co.uk, upi.com, pollar.news
