[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$funwml25cfjfCs2nzTbjS9m_-y-_m0uZudLVgVW4Y4t0":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"92b9371e-aad7-4e98-b372-fd3f9103fc64","Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists","leak-site-publishes-data-on-more-than-41-000-dhs-employees-obtained-by-hacktivis-4da8cc","The Department of Peace group shared it with Swiss hacker\u002Fjournalist maia arson crimew and DDoSecrets put it online. The post Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists appeared first on CyberScoop.","A hacktivist group known as the Department of Peace has leaked internal data belonging to over 41,000 Department of Homeland Security employees and contractors. The data, allegedly obtained by breaching an Okta single sign-on service used by DHS, was shared with hacker\u002Fjournalist maia arson crimew and published by DDoSecrets. The leak reportedly includes information on personnel involved in covert operations, leaker investigations, and deportation programs, offering a detailed look into the agency's structure.","Hacktivists leak data of over 41,000 DHS employees after breaching identity service.","https:\u002F\u002Fcyberscoop.com\u002Fdhs-employee-data-leak-ddosecrets\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F10\u002FGettyImages-2261368896-1.jpg","2026-10-28T21:33:00+00:00","2026-10-28T22:00:11.11858+00:00",8,[17,20,23],{"name":18,"type":19},"Okta","vendor",{"name":21,"type":22},"Department of Peace","threat_actor",{"name":24,"type":25},"AWS GovCloud","product","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":26,"icon":28,"name":29,"slug":30},null,"Breaches","breaches",[32,34,39,44],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,24],{"controls":52,"vendors":139},[53,81,110],{"slug":54,"name":55,"problem":56,"products":57},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[58,66,73],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":67,"vendor_name":18,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":82,"name":83,"problem":84,"products":85},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":111,"name":112,"problem":113,"products":114},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[140],{"slug":67,"name":18,"logo_path":68,"roles":141},[142],"affected",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":155},"hacktivist-breach-of-dhs-okta-sso-exposes-41000-employee-records","Hacktivist Breach of DHS Okta SSO Exposes 41,000 Employee Records","A hacktivist group breached an Okta single sign-on (SSO) service used by the Department of Homeland Security, exfiltrating sensitive data on over 41,000 employees and contractors. The compromise of a centralized identity provider created a single point of failure, meaning one successful attack unlocked access to a broad swath of personnel data. This incident highlights the critical risk of over-relying on a single SSO layer without compensating controls such as multi-factor authentication, privileged access segmentation, and least-privilege enforcement. The sensitivity of the exposed data — including individuals involved in covert operations and leak investigations — amplifies the national security implications beyond a typical corporate breach.",[148,149,150,151,152,153,154],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 6: Access Control Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 13: Network Monitoring and Defense","MITRE ATT&CK T1566: Phishing","GDPR Article 32",{"GDPR Article 32":156,"MITRE ATT&CK T1566: Phishing":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"CIS Control 6: Access Control Management":159,"CIS Control 13: Network Monitoring and Defense":160,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":161,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":162},"While a US government agency, this control mirrors the standard of implementing appropriate technical measures — including access controls and encryption — to protect personal data, exactly the safeguards absent here given the scale of personnel data exposed.","SSO credential compromises frequently begin with phishing; applying anti-phishing controls and phishing-resistant MFA directly addresses the likely initial access vector used against the DHS Okta environment.","If the Okta breach involved any known vulnerability or misconfiguration, a disciplined flaw remediation program would have identified and closed the exposure before attackers could exploit it.","CIS Control 6 requires enforcing MFA and managing privileged access — had these been rigorously applied to the Okta SSO service, the hacktivist group would have faced a much harder path to exfiltrating bulk employee records.","Continuous monitoring of authentication traffic and anomalous data access patterns on the SSO platform would have detected the bulk exfiltration in progress, enabling a faster containment response.","This control requires organizations to systematically identify and remediate technical vulnerabilities in systems like SSO providers, reducing the attack surface that the hacktivists leveraged.","The breach exploited the SSO layer; enforcing phishing-resistant MFA and least-privilege access under PR.AA would have significantly raised the barrier for attackers to move laterally after initial compromise."]