Five Things to Know About the DHS Staff Directory Leak, and What It Shows About Identity Data

A leak of personnel records from the U.S. Department of Homeland Security has become one of the most closely watched security stories of the past week. Apart from the politics around it, the incident shows how much an organization’s identity system reveals about it, and why that information needs protecting.

This explainer is based on The Philadelphia Inquirer’s November 1 report, which looked at the local impact, and WIRED’s analysis of the leaked records.

1. What was exposed

The records cover more than 41,000 employees and contractors across DHS and seven of its component agencies. They include names, work email addresses, phone numbers and office locations. WIRED reports that the data also lists membership in internal permission groups, more than 55,000 of them, whose names hint at sensitive programs and the software tools staff can use. WIRED says the records were last updated on August 19, 2026.

2. Who says they took it, and how

A group calling itself the Department of Peace claimed responsibility, and the transparency nonprofit Distributed Denial of Secrets published the archive, which it calls “Icepick.” The group says the data came from DHS’s Okta single sign-on system. Okta told WIRED it has no evidence that its own systems or data were compromised. How the group actually obtained the records has not been publicly confirmed.

3. The local footprint

The Inquirer found 483 Pennsylvania-based DHS staff in the data, about 285 of them in Philadelphia, along with 47 employees at ICE and U.S. Citizenship and Immigration Services field offices in Mount Laurel, New Jersey.

4. What DHS has said

A DHS spokesperson said the department is aware of a potential breach, is working to address it, and will update the public as more information becomes available.

5. Why security teams are paying attention

Even without passwords or Social Security numbers, a complete staff directory is valuable to attackers. It tells them who works where, who reports to whom, which phone numbers reach which people, and, through group names, which systems each person can open. That is the raw material for targeted phishing, phone-based impersonation and help-desk social engineering.

What this means for your company

Your own sign-in platform, whether it is Microsoft Entra ID, Okta, Google Workspace or another service, holds the same kind of map of your business. Treat it as sensitive. Limit which accounts and connected apps can read the full directory, review third-party integrations that were granted directory access, and avoid group names that spell out sensitive projects or clients. Require phishing-resistant multifactor sign-in for administrators, watch for unusual bulk directory exports, and train staff to verify unexpected calls or messages that cite internal names and titles, because a leaked directory makes those messages sound legitimate.

Curious how much of your organization an outsider could map from a single compromised account? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.