A significant data breach has exposed the personal information of more than 40,000 employees of the U.S. Department of Homeland Security (DHS), according to Distributed Denial of Secrets, a nonprofit data transparency group. The leaked data includes details about employees in sensitive areas such as surveillance and human intelligence.

DHS has acknowledged awareness of a "potential breach" and stated it is actively working to address the situation and ensure employee protection, promising to provide updates as more information becomes available. The agency has not yet confirmed the extent of the breach.

The data, allegedly obtained by an entity identifying as "Department of Peace," includes names, phone numbers, email addresses, and job titles of personnel from various DHS components, including Immigration and Customs Enforcement, Customs and Border Protection, Homeland Security Investigations, and the Cybersecurity and Infrastructure Security Agency. The information also reveals details about assignments to special operations, undercover work, and computer forensics.

This incident marks the third major government data leak to gain public attention in the past month. In September, the hacking group ShinyHunters claimed responsibility for stealing data from the FBI, and last week, the Defense Department faced a class-action lawsuit following a breach affecting millions of military personnel.

Distributed Denial of Secrets stated that the hacktivist known as "maia arson crimew" developed a search tool for the data, aiming to provide greater public transparency and accountability. The "Department of Peace," which previously claimed responsibility in March for hacking DHS and releasing documents related to vendor contracts, stated that the leaked information should be used "to limit further harm by the DHS."

The data appears to have been harvested from the Okta sign-on service used by DHS. Okta has issued a statement asserting that its systems are secure and that there is no evidence of its own data or systems being compromised.

While Reuters could not independently verify the entire data trove, the news agency was able to match personal information for six DHS employees found in the leak to public records and dark web data, and confirmed phone numbers for three individuals directly. In some instances, the leaked data contained information readily available on public profiles, while in others, it revealed non-public details about internal organizational structures, programs, or operations.