Agencies that spend their days collecting other people’s information rarely expect to see their own spilled across the internet. The leak website Distributed Denial of Secrets said Wednesday it has released data on more than 40,000 Department of Homeland Security employees, including details about officials working in sensitive fields such as surveillance and human intelligence.

DHS Responds

DHS said in a statement it was “aware of a potential breach and is actively working to address the situation swiftly and effectively.” The agency said it was working to ensure its employees were properly protected and would update the public “when more information is available.”

Third Major Government Leak in a Month

The nonprofit data transparency group says the disclosure draws on information obtained by an entity calling itself “Department of Peace.” It is the third major government data leak to make headlines in the past month.

The Earlier Breaches

In September, the hacking group ShinyHunters claimed the theft of a massive trove of data from the Federal Bureau of Investigation, including sensitive job details and medical information from thousands of bureau employees. Last week, the Defense Department was hit with a class action lawsuit after a breach exposed data on millions of current and former military personnel.

What the Data Contains

The DHS data includes names, phone numbers and email addresses of employees from Immigration and Customs Enforcement, Customs and Border Protection, Homeland Security Investigations, the Cybersecurity and Infrastructure Security Agency and other DHS component agencies.

More Than a Phone Book

Also included were job titles and email groups, which, among other details, showed which agents were assigned to special operations, surveillance jobs, computer forensics and undercover work.

A Searchable Tool for the Public

Distributed Denial of Secrets co-founder Emma Best said in a statement that the hacktivist and journalist known as “maia arson crimew” developed a search tool allowing the public to browse the data. Best said the tool would “replace anonymity with accountability” and empower journalists, guide public records requests and boost congressional oversight. Crimew said it would provide “FOIA material for years to come!”

The Hackers’ Justification

The Department of Peace did not immediately respond to a request for comment. In a statement included with the data, it said DHS employees “have our information, so it’s only fair that we have theirs,” and that it hoped the data “can be used to limit further harm by the DHS and supports all efforts in that direction.”

The group claimed responsibility in March for hacking DHS and posting documents about contracts with outside vendors.

The Okta Claim

Best’s statement said the Department of Peace harvested the data from the Okta sign-on service used by DHS. Reuters could not immediately corroborate that claim. Okta said in response to a Reuters query: “Okta is secure, and we have no evidence our data or systems were compromised.”

Verifying the Trove

Reuters could not immediately verify the authenticity of the entire data set, but it matched personal information about six named DHS employees to credit bureau records and breach data carried by the dark web intelligence platform District 4 Labs. Reuters called three DHS employees directly and confirmed their phone numbers and other details. One said it was the first they had heard of a breach.

Public Details and Private Ones

In several cases, the data tracked information available on employees’ LinkedIn profiles. In others, it revealed nonpublic details about internal DHS organization charts or previously undisclosed programs or operations.

For employees whose jobs depend on staying out of view, the question now is not only who gets to read the list, but what can be done once it is public.