DHS Employee Data Breach: What ICE, CBP, and USCIS Employees Should Do Now
A reported data breach at the Department of Homeland Security has put the names and assignments of more than 41,000 employees and contractors into a searchable database online. If you work at ICE, CBP, or USCIS, has your agency told you whether you are in it? Here is what has been reported, and what federal employees should do now.
What Has Been Reported
A group calling itself the Department of Peace says it got into DHS systems through the department’s single sign-on. The leaked information reportedly covers more than 41,000 employees and contractors, including undercover investigators, and it is searchable online. DHS has said only that it is “aware of a potential breach.” Reporters have already reached agents through the leaked contact information, in some cases before anyone had told those agents about the leak. The reporting comes from The Washington Post (Maria Sacchetti, Ted Hesson, and Aaron Schaffer, October 28, 2026).
Do Not Search the Leaked Data on a Government Device
Do not access the leaked information or try to search through it on any federal computer or on anything the government may have access to. Doing so could lead to charges and disciplinary action. Assume your federal employer is monitoring every device that connects to its systems. Federal employees likely have little or no privacy right in that use.
What to Expect From Your Agency
Expect a notice. Federal breach-response rules call for your agency to assess the risk to you and tell you what information got out. You do not need to wait for that notice to protect yourself.
Steps to Take Now
Change your password, and change any other password that shares it. Remove your home address from data broker sites. If you receive a threat, report it to your supervisor in writing. If your assignment is no longer safe, say so in writing as well. Your agency’s answer, or its silence, becomes part of your record.
What About Lawsuits?
Expect lawsuits, and expect them to move slowly. Under the Privacy Act, an employee generally must show that the agency acted intentionally or willfully and that the employee suffered actual losses. The earlier OPM data breach took years to resolve and ended in a $63 million settlement.
Whatever one thinks about immigration enforcement, these are more than 41,000 DHS employees and contractors who deserved to hear about this from their agency, not from a reporter. To keep up with developments like this one, sign up for our free newsletter.
Legal Disclaimer: This content is for general informational purposes only and does not constitute legal advice. Federal employment situations are fact-specific and time-sensitive. Please consult a qualified federal employment attorney about your specific situation. You can contact Southworth PC at attorneysforfederalemployees.com.