In a development that will surprise absolutely no one who has been paying attention to the cybersecurity industry's annual game of Whack-a-Mole, a hacker has stolen personal information from more than 41,000 Department of Homeland Security employees. The breach, first reported by TechCrunch and Wired, exposes names, job titles, phone numbers, email addresses, and office locations of DHS staff - including those at US Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP). Because nothing says "homeland security" like leaving the front door unlocked.

The hacker, operating under the delightfully passive-aggressive moniker "Department of Peace," gained access through Okta, the identity and access management service the DHS uses. Roughly 21,000 of the records belong to CBP employees, while nearly 7,000 pertain to ICE staff. The dataset also includes records from the Cybersecurity and Infrastructure Security Agency (CISA), US Citizenship and Immigration Services (USCIS), and Homeland Security Investigations (HSI). So, essentially, a full tour of the department's org chart, minus the coffee mug.

The DHS has reportedly been working to conceal the identities of CBP and ICE agents - who have been conducting anti-immigration raids across the US and tracking down online critics - which makes this leak particularly awkward. "They have our information, so it's only fair that we have theirs," the "Department of Peace" hacker told TechCrunch, offering a rationale that would make any playground justice warrior nod in solemn agreement. The leak comes just weeks after hackers stole data from the FBI on its employees and job applicants, suggesting that federal agencies are currently competing in a game of "who can lose their data most dramatically" - and winning is not the goal.

The stolen DHS information was reportedly handed to hacktivist maia arson crimew, who shared it with Distributed Denial of Secrets (DDoSecrets), a nonprofit now hosting the leaked "Icepick" dataset. Because if you're going to leak sensitive government data, you might as well give it a memorable name. The dataset also includes information about DHS groups with access to surveillance tools like the facial recognition app Mobile Fortify and PenLink, which can collect and analyze data from phones and online services. So not only do we know who works there, we also know which toys they get to play with.

The DHS did not immediately respond to The Verge's request for comment - presumably because they were busy changing their Okta passwords.