VULNpocalypse
HighBreach / campaignOngoing

DHS employee data leak: 41,000 workers exposed in Icepick archive said to come from Okta login system

A group called Department of Peace leaked records on more than 41,000 DHS staff and contractors, which it says came from the DHS Okta login system.

Published
Updated
Exploitation
Yes, the stolen records were published as the Icepick archive by DDoSecrets, but how the breach was carried out is not confirmed

What happened

A leak of Department of Homeland Security records exposed details of more than 41,000 employees and contractors across DHS and seven component agencies, according to WIRED. The records include email addresses, phone numbers and office addresses. They also include references to internal systems and to undercover and surveillance programs. WIRED says the records were last updated on August 19, 2026.

A group calling itself the Department of Peace supplied the data to the nonprofit Distributed Denial of Secrets (DDoSecrets) and to researcher and journalist maia arson crimew. DDoSecrets published the archive, called “Icepick,” on Wednesday, October 28, 2026 (WIRED). DDoSecrets says the data comes from the DHS Okta login system. TechCrunch describes the source as an Okta single sign-on system that lets employees and contractors across DHS agencies log in to its central network. CyberScoop reports the group’s spokesperson said the same.

What the data contains

  • TechCrunch reports names, job titles and work contact details, plus IT and log-in records tied to each account, including which systems and internal apps a person may access.
  • WIRED says the records name over 55,000 permission groups. Some appear to reference undercover operations, wiretap programs, Palantir’s Falcon platform and PenLink.
  • Most records also name a supervisor, which WIRED says could let someone reconstruct reporting relationships across the department.
  • TechCrunch reports the Okta-linked data also shows membership in Active Directory user groups that control access to internal tools and third-party services.

Scale

  • WIRED says CBP accounts for more than half of the records, and TechCrunch puts that at about 21,000.
  • Both outlets put ICE at about 10,000 records.
  • WIRED counts about 6,200 for USCIS and nearly 1,000 for CISA, more than half of those contractors. TechCrunch also says just under 1,000 are CISA staff.
  • The sources disagree on how much of the DHS workforce this covers. WIRED says about a seventh, while TechCrunch says about one-fifth of roughly 220,000 staff.
  • CyberScoop says the data goes back years, with group names referencing COVID-19 planning and 2023 summits. It also verified that numerous current CISA employees appear in it.

Timing and authenticity TechCrunch says the records appear to have been exfiltrated around mid-August, judging by per-record timestamps. It verified a portion of the data by matching known DHS employees against an offline copy of the database.

Responses

  • Okta told several outlets: “Okta is secure, and we have no evidence our data or systems were compromised.” That is the quote in WIRED, TechCrunch and CyberScoop.
  • A DHS spokesperson said DHS “is aware of a potential breach and is actively working to address the situation swiftly and effectively.”
  • TechCrunch says it is unclear whether the underlying vulnerability has been fixed. How the breach was carried out is not confirmed, because the hacker did not answer questions.
  • Recorded Future’s Alexander Leslie told WIRED the dataset is “an extraordinarily valuable intelligence resource” if authentic and current. He said it becomes more valuable when correlated with other compromised data, and could support targeting of personnel and convincing impersonation attempts.

Takedowns and platform blocking

  • Bluesky is blocking links to the archive and to crimew’s search site, saying the files include email addresses and phone numbers shared without authorization (WIRED, TechCrunch).
  • DDoSecrets co-founder Emma Best disputes that, saying the data holds professional contact details and not home addresses.
  • According to TechCrunch, DHS filed a takedown notice through the security vendor ZeroFox for the search site. The domain was placed on “serverHold” and no longer loaded on Thursday morning. Whether a government demand prompted the registrar is not confirmed. Crimew also made a locally hosted version of the data.
  • CyberScoop’s update says the website hosting the searchable data was taken offline as of Thursday morning.

Context The hacktivists said the breach was a response to a statement by DHS Secretary Markwayne Mullin about “turning up the heat” on ICE (CyberScoop). TechCrunch says the same hacker earlier claimed to have taken thousands of contracts between DHS and private sector firms. That earlier claim is not independently detailed in these sources.

Am I affected?

You may be affected in any of these cases:

  • You are a DHS employee or contractor. The leak covers DHS and seven component agencies, including CBP, ICE and HSI, USCIS, CISA and the Federal Protective Service. If you are in the archive, your name, work contact details, supervisor and group memberships may be exposed. Whether any given person is included is not confirmed from the sources.
  • You work with someone at DHS. Colleagues, vendors and partners are plausible targets for impersonation, a risk Recorded Future’s Leslie pointed to.
  • You run Okta or another single sign-on service. Okta says it has no evidence its own data or systems were compromised, and the intrusion method is not confirmed. No Okta vulnerability, CVE or fix is named in the sources.

No CVE, affected software version or patch is named in any source.

What to do now

  1. If you are at DHS or a DHS contractor, treat your work email, phone number, office location and access-group memberships as publicly known. Report suspicious messages to your security team.
  2. Be cautious with unexpected contact. Calls, texts or emails that cite your supervisor, projects or internal systems may be impersonation attempts built from this data. Verify through a separate trusted channel before acting.
  3. Review access. Confirm your own group memberships and application access are still needed, and ask your administrators to remove any that are not. The exposed group names reveal which tools people can reach.
  4. Identity administrators: review sign-in and administrative activity for your SSO tenant, especially around mid-August 2026, and enforce phishing-resistant MFA. This is general precaution. The sources do not say how the data was taken.
  5. Check your organization’s policy before downloading or sharing the archive. Platforms and registrars are treating it differently. Bluesky blocks links, a domain was placed on serverHold after a DHS takedown notice, and DDoSecrets defends publication. Get legal and security guidance first.
  6. Watch for official updates. DHS said it will update the public when more information is available, and the status of the underlying vulnerability is not confirmed.

Sources