The names, phone numbers and field office assignments of more than 40,000 employees of the United States Department of Homeland Security (DHS) have been exposed in a large-scale data breach reported on Wednesday 29 October 2026.

Why staff contact data matters

According to Bloomberg Law, the exposed records cover staff at Immigration and Customs Enforcement, Customs and Border Protection, US Citizenship and Immigration Services, the Federal Law Enforcement Training Center, the Cybersecurity and Infrastructure Security Agency, and the Federal Protective Service. About 15 per cent of the department's workforce is estimated to be affected, based on recent staffing figures. DHS said it was aware of a potential breach and was working to address the situation.

What remains unclear

Names and phone numbers may sound low-risk beside passwords or financial records, but security specialists warn that they are valuable for targeted phishing. A convincing message that already knows a person's role, office and colleagues is far more likely to be opened, and a single compromised account can then be used to reach further systems. The leak follows a run of thefts aimed at US government personnel files, including records taken from FBI staff and a long-running intrusion affecting defence personnel data.

The timing adds to the concern. With US midterm elections approaching, officials have flagged the risk of impersonation messages aimed at government workers.

It is not yet publicly established how the data was obtained, and the department has not, in the reports seen, confirmed the full scope or entry point. Affected staff should treat unexpected calls, texts and emails with extra caution and verify unusual requests through a known channel.

Sources: Bloomberg Law, Technology.org.