A leak website was published Wednesday, showcasing internal data on more than 41,000 Department of Homeland Security employees and contractors after it was obtained by hackers who claimed to have breached an identity service used by the agency.  

The transparency nonprofit Distributed Denial of Secrets and the hacker maia arson crimew got the data from a hacktivist outfit known as the Department of Peace.

”The leak is extraordinary but deceptive in [its] simplicity as it identifies the officials responsible for overseeing covert and undercover operations, the government’s hunt for leakers and the failed BlueLeaks investigation — along with key personnel in DHS’s ever-escalating rendition and deportation programs,” said Emma Best, founder of DDoSecrets.

CyberScoop was able to verify numerous current Cybersecurity and Infrastructure Agency employees are listed in the data, along with some former leadership members who left the agency years ago.

The data goes back years, with various group names listed in the database making reference to COVID-19 planning and internal summits in 2023.

As of Thursday morning, the website hosting a searchable form of the data has been taken offline.

The hacktivists said the breach was a response to the promise of stepped-up operations from Immigrations and Customs Enforcement by DHS Secretary Markwayne Mullin.

”On July 17th, Markwayne Mullin said he was ’turning up the heat.’ This is what happens to ICE when you do that,” said a spokesperson for the Department of Peace.

The spokesperson said they obtained the database from an Okta single sign-on service used at DHS. Okta said it was aware of the report.

“Okta is secure, and we have no evidence our data or systems were compromised,” an Okta spokesperson said.

DHS did not immediately respond to a request for comment.

”This dataset is massive in terms of both size and impact,” said crimew, a Swiss hacker and journalist who has been indicted in the United States over past leaks and who created a search tool for the DHS data. “It provides an unprecedented look into the Department of Homeland Security’s organizational structure, highlighting which people do what work across multiple DHS agencies, including ICE.”

One researcher said the leak could prove valuable for Freedom of Information Act requests.

“Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results,” Ryan Shapiro, executive director of Property of the People, said. “Given the Trump administration’s contempt for even basic transparency, the need for such tools is urgent.”

DHS has suffered notable breaches before, dating back to a 2014 breach that may have exposed the data of 390,000 then-current and former Homeland Security Department employees, job applicants and contractors. In 2018, DHS notified nearly 250,000 people of a breach at the department.

Earlier this year, Security firm GitGuardian said it discovered a public GitHub repository that exposed credentials for privileged AWS GovCloud accounts and internal CISA systems dating back to November 2025.

Greg Otto contributed to this story.

UPDATE: 10/29/2026, 9:30 a.m.: This story has been updated with details about the web-based database being taken offline.

The post Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists appeared first on CyberScoop.

Okta announced Thursday it has signed a deal to buy Permiso Security, a cloud-based firm that tracks threats tied to human, machine, and AI-driven digital identities. 

Permiso specializes in spotting risks after a user or system has already logged in, an area the industry refers to as identity threat detection and response. The company draws on more than 2,500 signals gathered from over 70 identity-related partners to flag issues such as excessive access permissions, unused credentials, unusual behavior from AI agents, and violations of internal security policies.

Ely Kahn, Okta’s chief product officer, told CyberScoop that Permiso will allow Okta to merge two functions that have operated separately: real-time threat detection and identity security posture management. “Today those are two separate products that don’t really talk to each other,” he said. 

Combining them, Kahn said, produces sharper alerts for security teams. As an example, he described a hypothetical scenario where a dormant administrator account is flagged by posture-management tools that later shows a login from an unfamiliar IP address. “By combining those things, you now have a very high-confidence, high-fidelity alert that’s more actionable by a security operations team,” Kahn said. “A security operations team on its own might not care about the dormant account, but when you combine that with some threat signals, then it becomes a higher critical-level alert.”

A crucial part of the deal, according to Kahn, is that Permiso will bring visibility beyond Okta’s current threat detection products, telling CyberScoop that customers also rely on other identity systems, such as Microsoft Entra ID or Active Directory, that fall outside that view.

“For us to be a real player in the identity security space, we have to look beyond the Okta perspective and give folks a full view into their identity threats,” he said.

The acquisition also fits into a security landscape reshaped by artificial intelligence. According to figures cited by Okta, 58% of executives say their organizations experienced an AI-related security incident or a near miss within the past year. That trend has pushed identity companies like Okta to expand beyond authentication and into continuous monitoring of what accounts, including AI agents, actually do once inside a system.

“Agents will be breached,” Kahn said. “The most important thing you can do is ensure that if an agent is compromised, the blast radius is small,” through a narrowly defined, revocable identity tied to each agent. 

Among the capabilities Okta says it will gain is a tool called SandyClaw, which tests AI agent skills and prompts in an isolated environment before they are allowed into a customer’s systems, aiming to catch supply-chain attacks embedded in AI tools. Other planned additions include expanded tracking of AI agent behavior across cloud platforms and software-as-a-service tools, and automated systems to investigate and isolate AI agents that appear compromised or misconfigured.

The transaction is expected to close in the third quarter of Okta’s 2027 fiscal year, pending standard regulatory and closing conditions. Terms of the acquisition, including its purchase price, were not disclosed.

The post Okta’s deal for Permiso aims to close gaps in identity threat detection appeared first on CyberScoop.