Two government agencies were hit by breaches in the same week. On Wednesday, a leak site published a searchable database of more than 41,000 people who work for Homeland Security. It included names, cell numbers, office locations, and every permission group they belong to. The next day, Florida’s Department of Education reported that its student financial aid website had been breached, and approximately 4.9 million people may have had their Social Security numbers exposed. One agency lost its internal map of people and access. The other lost people’s identities.
Homeland Security Data Appears on a Leak Site
A group calling itself the Department of Peace claimed it pulled the data from the Okta single sign-on system that DHS uses. Single sign-on means one login opens every app at work. Okta stated that Okta is secure and that it has no evidence its data or systems were compromised. No one has confirmed how the group gained access.
Wired counted more than 41,000 employees and contractors across DHS and seven of its agencies. ICE alone accounts for about 10,000 of them. Nearly 1,000 are tied to CISA, the agency whose whole job is defending America’s networks. Reuters confirmed details directly with three DHS employees, and the data checked out.
The data also contained over 55,000 permission groups. These groups decide who can open which app. Thirty-nine people at Homeland Security Investigations sit in groups tied to certified undercover operations. Others reference WireTap programs, Palantir, and Penlink. Biometric Update described the release as a seed graph. A Recorded Future expert told Wired that an adversary could spend months exploiting these relationships.
Timing details add context. Wired reported the records were last updated on August 19. TechCrunch said they appear to have left around mid-August. The public learned of the leak on October 28. DHS said it is aware of a potential breach. It asked an Icelandic hosting company to take the material down. The company refused, and the search site later reappeared on a different domain.
Earlier warnings existed. A 2023 Inspector General audit found that 159 of 190 former ICE personnel—84 percent—still had access after their last day. Four of the seven recommendations from that audit remain open.
Florida’s Student Financial Aid Site Is Breached
On Thursday, the Florida Department of Education posted that it had been hit by unauthorized criminal access affecting approximately 4.9 million people. The target was the Florida Student Financial Aid website, the state’s main site for scholarships and grants such as Bright Futures. The state said that if you have previously applied for financial aid in Florida, your information may have been affected.
What may have been exposed includes Social Security numbers, first and last names, dates of birth, home addresses, phone numbers, email addresses, and gender codes. That is a complete identity kit. Many of the people involved are teenagers who are not checking their credit reports.
Staff became aware of the breach on October 19. The public heard about it on October 29—ten days later. When the Florida Phoenix asked how long the breach lasted, the response was that the question was not an answer. The department has not identified a suspect or said how the intrusion occurred. It brought in the Florida Digital Service and the Florida Department of Law Enforcement, notified the Attorney General, and said current financial aid is not at risk. The aid website continued to show a maintenance page.
What Both Incidents Point To
Neither agency has said how the attackers got in. Both stories, however, point to the same underlying issue: the front door held more than it needed to, and nobody noticed until the data was already out.
Practical Steps for Affected People and Organizations
If you or your children applied for aid in Florida, freeze your credit with all three major bureaus. A freeze stops new accounts from being opened in your name. Watch for texts and emails about Bright Futures or financial aid, and only trust contact details listed on the department’s own breach page.
If you run a business, pull a list of every login and every permission group. Kill accounts the day someone leaves. Review access when people change jobs. Set an alert for anyone who reads your whole directory. And if you do not need a Social Security number, do not store it.
Finding Gaps Before Data Leaves
StartupHakk Security runs penetration tests and security assessments for companies of every size. You can start with a free scan at security.startuphack.com. The goal is to know who has your keys before somebody else does.
Most founders cannot answer how many critical vulnerabilities sit in their production systems right now. Shipping quickly while security stays on a later list creates blind spots. Familiarity with the code hides cracks until an incident puts the company in the news. Startuphakk Security offers two free-to-start, AI-powered services that deliver real findings within an hour and are engineer-verified to limit false positives. The AI site scan runs non-destructive, security-focused checks against a live attack surface for issues such as injection flaws, broken access controls, cross-site scripting, and open redirects. The free tier returns the top three highest-severity findings with evidence. The AI code scan accepts a zipped codebase (no GitHub access required) and checks every file for hard-coded secrets, vulnerable dependencies, injection flaws, and broken access control. It likewise returns the top three findings with remediation guidance. Both run on a private AI harness at openmonoagent.ai rather than in the cloud.
Automated scans catch low-hanging fruit quickly but do not replace people who think like attackers. When deeper work is needed, the same team performs full penetration tests, architectural assessments, attack simulations, and prioritized remediation roadmaps. Security does not have to slow development; done properly, it can let teams move faster without constant worry. The free scans are available at security.startuphakk.com.
Conclusion
Neither agency explained how the attackers got in. Both cases show the same problem: access stayed open longer than it should have, and no one noticed until the data was already public. The practical response is straightforward—freeze credit if you may have been affected by the Florida breach, tighten permission groups and offboarding in any organization, and stop storing Social Security numbers you do not need. For companies that want to find similar gaps first, the free scan at security.startuphack.com is the starting point offered in the discussion.
