Identity
DHS staff directory leak: what an SSO export gives attackers
Data on 40,000+ DHS staff, claimed to come from its Okta sign-on, is public. What an identity directory export exposes, and how to audit your own Okta org.
Names, job titles, work email addresses, phone numbers and internal group memberships for more than 40,000 current and former US Department of Homeland Security (DHS) employees and contractors were published on October 28. A hacktivist group calling itself "Department of Peace" took the data and passed it to the hacker and journalist maia arson crimew, who shared it with Distributed Denial of Secrets (DDoSecrets), a nonprofit that hosts leaked datasets. The records cover Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), Homeland Security Investigations (HSI), the Cybersecurity and Infrastructure Security Agency (CISA) and other DHS components.
The group says the data came from the Okta single sign-on (SSO) service DHS staff use to log in. Nobody has confirmed that. Reuters could not corroborate the Okta claim, Okta says it has "no evidence our data or systems were compromised", and DHS says only that it is "aware of a potential breach". Whatever the route, the dataset shows what an identity provider's directory holds, and any organisation running Okta, Microsoft Entra ID or a similar service has the same kind of data in one place.
What was published
Three outlets checked samples independently. TechCrunch matched several known DHS employees against an offline copy. Nextgov/FCW matched an official's work phone number it already had, and found job titles that matched LinkedIn profiles. Reuters matched six employees against credit bureau and earlier breach records and confirmed details directly with three employees, one of whom had not heard of a breach. Nextgov notes that some records are historical: it found CISA staff who have since left.
TechCrunch adds detail the others do not, so treat it as single-source. It reports about 21,000 CBP records, about 10,000 for ICE and HSI and just under 1,000 for CISA, and says timestamps suggest the data was taken around mid-August. It also reports that Active Directory group memberships show which apps each account can reach, from Microsoft 365 and Citrix to more than 2,000 HSI users in a group tied to the surveillance vendor Penlink.
Nextgov and Reuters both say job titles and group names reveal which staff work on surveillance, computer forensics and undercover operations. The same group claimed a DHS breach in March, when it posted documents about the department's contracts with outside vendors.
Why a directory export is worth stealing
An identity provider (IdP) sits between staff and every application they use. To do that it holds a profile for each person, the groups they belong to, and the apps those groups unlock. That makes it an accurate org chart, because access stops working when it is wrong.
None of that is a password, and DHS has not said whether any credentials were involved. It is still the input an attacker needs for the next stage:
- Phone numbers plus titles make voice phishing (vishing) believable. A caller who knows your manager's name and the apps you use can pose as the help desk and ask you to approve a push prompt or read out a code. The same numbers are the starting point for SIM swap attempts, where an attacker talks a carrier into moving the number to their own SIM to receive text message codes.
- Group memberships are an access map. They show who holds admin roles, who has VPN or Citrix access, and which few people can reach a sensitive system, so the attacker phishes those people first.
- Email addresses in a consistent format give a ready list for password spraying, where one common password is tried against every account, and for targeted phishing.
Nextgov makes the same point: the leaked assignments and connections could help malicious actors pick sensitive targets and craft convincing impersonation attempts.
How a directory leaves an IdP
Neither DHS nor the group has said how the data was taken, so the paths below are general, not a description of this incident. In Okta, a full user list with group memberships can be read through the admin console, through an app integration that syncs the directory, or through the management API.
According to Okta's documentation, an API token carries the permissions of the admin who created it, and super admins, org admins, group admins, group membership admins and read-only admins can all create one. A token stays valid as long as it is used at least once every 30 days, and by default it works from any IP address. A stolen admin session or a forgotten token from an old integration can therefore read the whole directory without anyone signing in interactively.
What to do
1. Review who can read the whole directory
In the Okta Admin Console, open Security > Administrators and list every account with an admin role, including read-only admin. Remove roles nobody can justify, and check that each remaining admin signs in with phishing-resistant authentication such as FIDO2 security keys or Okta FastPass rather than SMS codes.
2. Review API tokens
Go to Security > API and open the Tokens tab. For each token, check who created it, when it was last used and its network restriction. Revoke any token whose owner has left or whose integration you cannot name. For the rest, set the restriction to a network zone holding only the integration's IP addresses. Because a token inherits its creator's rights, a token made by a super admin can do anything a super admin can; recreate integration tokens under a dedicated service account with the narrowest role that works.
3. Search the System Log
Under Reports > System Log, search back at least 90 days for these event types, using filters such as eventType eq "system.api_token.create":
system.api_token.createandsystem.api_token.revoke: tokens created or removed, and by whom.user.account.privilege.grant: admin roles granted.user.session.access_admin_app: sign-ins to the admin console. Look for unfamiliar IP addresses, countries or user agents.user.session.impersonation.initiate: support impersonation sessions.user.mfa.factor.deactivateanduser.mfa.factor.reset_all: authenticator resets, a common step after a successful help desk call.system.org.rate_limit.warningandsystem.client.rate_limit.violation: rate limit hits, which a bulk read of a large directory can trigger.
Stream the System Log to your SIEM (security information and event management system) so these searches can reach further back than Okta keeps the log.
4. Limit what apps receive
Every app integration gets the attributes and groups you map to it. In Directory > Profile Editor, open the app's Mappings and the Okta User to App tab, and drop attributes the app does not use, such as mobile phone. For OpenID Connect apps, the groups claim on the app's Sign On tab is often set to the regex .*, which sends every group the user belongs to. Replace it with a pattern that matches only the groups the app checks.
5. Warn staff before the calls start
If your directory may have been exposed, tell staff what to expect: calls or texts that quote their manager, team or apps. Tell them the help desk will never ask them to approve a push prompt or read out a code, and give them one internal route to report it. Okta's user.account.report_suspicious_activity_by_enduser event records when users report an unexpected sign-in prompt. Ask your mobile carrier for a SIM lock or port-out PIN on company phones, and move admins off SMS codes entirely.
What is not known
DHS has not confirmed the Okta route, whether credentials or tokens were taken, or whether the access has been closed. TechCrunch reports it is unclear whether the hole was fixed.
Our safeguarding and hardening work covers IdP admin roles, API tokens and attribute mappings, and our security operations team builds the System Log detections listed above. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: TechCrunch, Nextgov/FCW, Reuters via The Korea Times, Okta: manage API tokens, Okta System Log event types, Okta: map profile attributes, Okta: customize the groups claim.