The facts

  1. The disclosure includes names, job titles, work contact details, office locations and internal permission-group information. [3]

  2. TechCrunch said it authenticated a sample against known DHS employees. [2]

  3. An attacker claimed access through DHS’s Okta login. Okta told WIRED it had no evidence of a breach of its own systems. DHS did not respond. [1]

  4. WIRED says the records were last updated on 19 August. [1]

  5. FlokiNET published its account of receiving and declining the notice on 29 October. It said the registrar separately placed the original domain on hold. The host's refusal did not prevent that suspension. [4][5]

  6. Al Jazeera reported that ZeroFox's letter, sent on DHS's behalf, sought removal or disabling of the material and cited risks to more than 40,000 identifiable people. This is the letter's claim, not a newly verified count of distinct employees. [5]

  7. The hosting company and Al Jazeera said the information subsequently appeared under another domain. This article does not reproduce the records, identify affected individuals or link to the dataset. [4][5]

Still unconfirmed

  • The entry method, full scope of affected people and whether unauthorized access persists remain unestablished.

Corrections & updates

Update, 29 October: Added the documented removal request sent through ZeroFox, FlokiNET's refusal and the reported registrar suspension. These are material developments in the response to the earlier disclosure; no leaked personnel data or mirror links are reproduced.

Source-link correction, 29 October: Corrected the Al Jazeera citation to the exact article read. An erroneous extra suffix produced a broken link. The reported takedown request, host response and registrar suspension are unchanged.

Sources

References support the numbered facts above. Source checks: 29 Oct 2026, 23:18 UTC.

The added primary source is the hosting provider's own account, corroborated in Al Jazeera's actual reporting on the notice. Earlier WIRED and TechCrunch examination of the collection is retained. No leaked dataset, credentials, personal records or mirror site was accessed; the breach method remains unconfirmed.

  1. Analysis of the DHS personnel disclosure

    WIRED · Reporting · 28 Oct 2026

  2. DHS breach report and sample authentication

    TechCrunch · Reporting · 28 Oct 2026

  3. Reporting on the DHS records disclosure

    The Verge · Reporting · 28 Oct 2026

  4. Hosting provider's account of the DHS takedown request

    FlokiNET · Primary source · 29 Oct 2026

    Actual host statement read as an involved party's account. Its legal and political arguments are not adopted. Links to the leaked dataset were not followed or reproduced.

  5. Trump administration attempts to take down leak of ICE personnel data

    Al Jazeera · Reporting · 29 Oct 2026

    Actual report by Umar Farooq read, including the contractor's letter, provider's response and registrar suspension. Al Jazeera is separate from FlokiNET, ZeroFox and DHS.

Report a factual error