What leaked. Names, job titles, work emails, cell numbers and office locations, plus each person's Active Directory group memberships, which show what systems and apps they can reach. About 21,000 records are Customs and Border Protection staff, about 10,000 are ICE and its HSI unit, and just under 1,000 work at CISA. Timestamps point to theft around mid-August. TechCrunch matched several known employees and says the data looks real. How the attacker got in: Undisclosed. DHS had not commented. Okta told TechCrunch: "Okta is secure, and we have no evidence our data or systems were compromised."
Why it matters. Even if Okta itself is fine, this is what an identity directory dump looks like to an attacker: a map of who has access to what. The group names reference Microsoft 365, Citrix, ChatGPT, surveillance vendor Penlink and teams working Salt Typhoon and Volt Typhoon cases. That's a ready-made target list for phishing and for picking which accounts are worth taking over. It is the second DHS leak this year claimed by the same hacker.
What I'd do today. Assume your SSO directory and group names are something an attacker could read, and stop naming groups after sensitive projects or vendors. Check who and what can query user and group data in your identity provider, including service accounts and admin API tokens, and alert on bulk directory reads. And warn staff in sensitive roles that their work cell numbers may be the next phishing channel.