DHS leak of 40,000 records: your SSO groups map your vendors
A hacker leaked data on 40,000+ DHS staff and claims it came from Okta, which denies a breach. Audit what your SSO directory reveals about your vendors.
A leaked staff directory is more than names. It is a list of the software a company uses. On October 28 TechCrunch reported that a hacker leaked records on more than 40,000 Department of Homeland Security employees and contractors. The hacker claims the data came from DHS's Okta single sign-on system. The group names in the data show which apps people use. Your SSO directory holds the same kind of map.
What actually happened
Per TechCrunch, the leaked records include names, job titles, work emails, phone numbers and office locations. About 21,000 relate to Customs and Border Protection and about 10,000 to ICE and its HSI unit. TechCrunch says the set equals about one-fifth of DHS's roughly 220,000-person workforce. It checked names against known DHS staff and says the data appears authentic.
The entry point is not confirmed. The hacker says the data came from DHS's Okta SSO. Okta told TechCrunch: "Okta is secure, and we have no evidence our data or systems were compromised." The hacker did not explain the method, and DHS did not answer TechCrunch's questions. Timestamps suggest the data left around mid-August 2026. We are not guessing at how it happened.
What we can see is the shape of the data. TechCrunch found group memberships tied to named products: a "Headspace_users" group with about 4,500 people, an HSI group tied to Penlink, and more than 200 CBP users linked to the Mobile Fortify app.
Why it matters for your business
Group names are reconnaissance. In most identity providers a group is named after the app it unlocks: quickbooks-admins, shopify-staff, stripe-finance. Anyone who reads your directory learns your vendor stack, who holds admin rights, and who to phish first.
Directory read access is wider than you think. Many SaaS tools that use SSO, plus some MCP servers and AI agents, can request permission to read users and groups. Every one of those connections is another copy of your org chart and app map.
Do this week:
- Pull a list of every app and API token with directory read scope in your IdP. Remove the ones that do not need it.
- Rename admin groups so they do not shout "finance-admins." Use neutral IDs and keep the mapping in your own docs.
- Turn on alerts for bulk user or group exports.
- Remove ex-contractors. A directory that is 20% stale is 20% free targets.
Key takeaways
- A leak of 40,000+ DHS staff records includes group memberships tied to named apps
- The hacker claims Okta SSO was the source; Okta says it has no evidence of compromise
- SSO group names reveal your vendor stack and your admins
- Audit which apps, tokens and agents can read your directory
- Alert on bulk exports and remove stale accounts
Not sure who can read your user directory? We audit SSO scopes, agent permissions and admin groups for small teams, then lock down what does not need access. See our security and systems work, or book an access review.
Sources: TechCrunch.
- #sso
- #okta
- #data-breach
- #identity
- #security
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Gheist: stolen GitHub tokens hit 850+ accounts, private repos
Wiz's Gheist report: stolen GitHub tokens planted 13,500+ secret-dumping workflow branches. Private repos weren't held. Hunt ci-sync branches, rotate, expire tokens.
Read itOVHcloud CLI backdoored: turn on GitHub release immutability
A hijacked account swapped OVHcloud CLI GitHub releases 0.11.0–0.15.0 for secret-stealing builds. Release immutability was off. Here's the fix.
Read it