Zero Radar
← feed
HighData breachupdated 29 Oct 2026, 20:02 UTC

Leak exposes personal and work details of 41,000 DHS staff

Records on tens of thousands of Homeland Security employees and contractors were posted publicly online, including contact details and information about sensitive assignments. Anyone who had their details exposed could be targeted by scams

Attacks reported (SecurityWeek)3 independent sources
SeverityHighData breach
Being exploited?ReportedBy SecurityWeek, not officially confirmed yet
What to doCheck exposureBe cautious with unsolicited contacts that reference your job, and verify them through official channels before responding.
How sure is this?3 independent sourcesSeveral independent publishers agree

How the attack works simplified

  1. 1Attacker gets accessRecords allegedly taken from the system
  2. 2Okta SSO systemSingle sign-on platform allegedly breached
  3. 3Staff records stolenContact and assignment details collected
  4. 4Published onlineSearchable records posted on a leak site
  5. Result41,000 staff records exposed publicly

What happened

Personal and work records for more than 41,000 current and former DHS employees and contractors were published on a leak site, allegedly stolen from an Okta single sign-on system earlier this year.

Why it is dangerous: Exposed contact details and assignment information can enable phishing, impersonation, and doxxing, with the risk highest for staff in sensitive roles such as undercover work.

Are you affected?

You are affected if you are a current or former DHS employee or contractor whose records were included in the leak.

DHS current and former employees and contractors; records allegedly taken from an Okta single sign-on system.

What to do

  1. Treat any email, call, or message referencing your DHS work with suspicion and verify through official channels.
  2. Watch for phishing that uses your name, role, or assignment details.
  3. Ask your security team whether your organization's Okta accounts and sign-in logs were reviewed after this incident.

Timeline

  1. 28 Oct 2026, 20:46 UTC
    Publicly disclosed
  2. 28 Oct 2026, 20:46 UTC
    Reported by Hacker News · Hacker News
  3. 28 Oct 2026, 21:03 UTC
    Reported by Hacker News · Hacker News
  4. 28 Oct 2026, 21:23 UTC
    Picked up by Zero Radar
  5. 29 Oct 2026, 13:05 UTC
    SecurityWeek reported on it · SecurityWeek
  6. 29 Oct 2026, 20:02 UTC
    DataBreaches.net reported on it · DataBreaches.net

Sources 4 reports, oldest first

Security press established security newsrooms

Community discussion sites, treat with care

Technical details

ID
ZR-80d0fea3 · ZR-9ca48659 · ZR-7cf47c0a
Disclosed
28 Oct 2026, 20:46 UTC
On Zero Radar
28 Oct 2026, 21:23 UTC (37 min after disclosure)
Last change
29 Oct 2026, 20:02 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Leak exposes personal and work details of 41,000 DHS staff · Zero Radar