A searchable dataset covering more than 41,000 current and former Department of Homeland Security employees and contractors went public on Wednesday, October 28, 2026. TechCrunch reported that a hacker stole personnel data on thousands of DHS staff, including agents at Customs and Border Protection and Immigration and Customs Enforcement. The DHS employee data leak puts the identities of federal law enforcement and security staff in a public search box, and it arrived with a notable claim about how the data was taken.
The group behind the theft calls itself Department of Peace. It says it reached the records through a DHS single-sign-on service run by Okta, and Distributed Denial of Secrets (DDoSecrets) published the result as a database named Icepick. We covered the first wave of reaction in our earlier Icepick leak report. This analysis goes a step further and looks at the access route, the agency-by-agency numbers, and what security teams outside government should take from it.
One caution applies to everything below. The reporting rests on the hackers’ account, DDoSecrets’ description and press analysis of the files. As of this writing, the coverage reviewed does not include a quoted DHS statement, and it does not establish the date of the intrusion or the full technical path. Where a claim is unproven, this article says so.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What DDoSecrets Published on October 28
DDoSecrets, the transparency collective that hosts leaked datasets, posted the Icepick database on October 28, 2026. The dataset is searchable, which changes its practical impact. A flat file of 41,000 rows asks a reader to do some work. A search box lets anyone type a name, an office or a job title and get an answer in seconds.
Headlines vary on the total. CBC News framed it as personal data on 40,000 employees, while other outlets reported more than 41,000. The gap is rounding rather than disagreement. We use “more than 41,000” because that is the larger of the two public figures and matches the dataset description.
The people listed are described as current and former employees and contractors. That mix matters for two reasons. Former staff often sit outside active security monitoring, and contractors frequently hold access through a different identity process than full-time federal employees. Both groups are easier to impersonate and harder to alert.
The security lessons do not depend on anyone’s politics. A database of identified law enforcement personnel creates risk for the individuals and for the agencies, whatever the motive of the people who published it.
Records by Agency: CBP, ICE, HSI and CISA
The reported breakdown shows where the exposure concentrates. About 21,000 records tie to U.S. Customs and Border Protection, roughly 10,000 tie to Immigration and Customs Enforcement and Homeland Security Investigations combined, and just under 1,000 tie to the Cybersecurity and Infrastructure Security Agency. The table below puts those figures next to their share of the 41,000 total. The shares are our own arithmetic, not figures published by DDoSecrets.
| DHS component | Reported records | Share of 41,000 (our calculation) |
|---|---|---|
| U.S. Customs and Border Protection (CBP) | About 21,000 | About 51% |
| ICE and Homeland Security Investigations (combined) | Roughly 10,000 | About 24% |
| Cybersecurity and Infrastructure Security Agency (CISA) | Just under 1,000 | About 2% |
| Remaining components and units | Not itemized in the reporting reviewed | Roughly 22% by subtraction |
| Total dataset | More than 41,000 | 100% |
CBP records make up about half the dataset. That makes the leak a field-office map as much as a name list. An attacker who knows 21,000 CBP identities and their locations can build a convincing pretext for almost any port of entry or sector office.
The CISA slice is small but strategically sharp. CISA coordinates cyber defense with critical infrastructure operators, so its contact details have value to any group that wants to impersonate a federal cyber official to a utility, hospital or state agency. Nextgov highlighted the combination of contact details and sensitive job information as the core problem, and the CISA records fit that pattern.
What Fields the DHS Employee Data Leak Contains
Reporting describes names, job titles, work email addresses, phone numbers, office locations or work addresses, and internal group memberships. Home addresses and Social Security numbers do not appear in the confirmed field list, and we are not claiming they were included. That distinction keeps this incident separate from the classic identity-theft breach.
Work contact data still carries real danger. A spear-phisher needs three things: a believable sender, a believable recipient and a believable reason. Icepick supplies the first two for tens of thousands of targets, and the group-membership field helps with the third. If a record shows someone belongs to a particular internal group, a fake message about that group’s tools or policies reads as authentic.
The internal group memberships deserve special attention. They are the kind of metadata an identity provider holds, because single-sign-on systems assign users to groups that control which applications they can open. Their presence in the dataset lines up with the hackers’ claim that the source was a login directory rather than a leaked spreadsheet.
The Okta Claim: What Is Alleged and What Okta Says
The hackers’ account
Department of Peace says it pulled the data through an Okta service that DHS uses for single sign-on. Politico described the group as a hacktivist outfit asserting it had obtained personal data on thousands of DHS employees. The group paired the release with a short statement, which WIRED quoted: “They have our information, so it’s only fair that we have theirs.”
The claim names a route but not a method. No coverage reviewed explains whether the attackers phished an administrator, stole a session token, abused a misconfigured tenant or used some other path. Without that detail, nobody outside the investigation can judge how repeatable the attack is.
Okta’s response
An Okta spokesperson responded to WIRED with a flat denial of any platform compromise: “Okta is secure, and we have no evidence our data or systems were compromised.” That statement is narrow. It says Okta’s own systems and data show no sign of a breach. It does not say DHS’s Okta tenant was untouched, and it does not rule out stolen credentials, a compromised administrator account or a misconfigured integration on the customer side.
Security teams will recognize the pattern. In most cloud identity incidents, the dispute is not about whether the vendor’s code failed. It is about who owned the configuration, the credentials and the monitoring. We saw the same shape in the TiDB Cloud breach, where a stolen service account gave an intruder 28 days of access.
Who Is Department of Peace and Why DDoSecrets Published
Little verified information exists about Department of Peace. The reporting describes a group that calls itself by that name and attributes the data to it. No outlet we reviewed ties the group to a named individual, a country or a prior campaign, and we will not speculate beyond that.
DDoSecrets plays a different role. It does not claim to have hacked anything. It hosts datasets that others obtained and decides what to release. Co-founder Emma Best told Techdirt that “Rather than an indiscriminate directory of every DHS employee, Icepick identifies many of the architects and drivers of DHS policy and operations.” That framing presents the release as targeted at decision-makers rather than the rank and file, though the 41,000-record scale makes that claim hard to square with the raw numbers.
Publishers in this space face a real tension. Releasing identified officials can support accountability reporting, and it can also expose people to harassment or worse. DDoSecrets has accepted that tension in past releases of law enforcement material, including its earlier BlueLeaks publication that Best referenced in remarks on this one. Readers should expect the argument over the ethics of Icepick to run for weeks, separate from the security analysis here.
What Analysts and Publishers Are Saying
Three public statements frame the debate. First, Best told CyberScoop that “The leak is extraordinary but deceptive in its simplicity as it identifies the officials responsible for overseeing covert and undercover operations, the government’s hunt for leakers and the failed BlueLeaks investigation”. Best presents the dataset as a map of oversight roles, not a random sample.
Second, researcher and journalist Maia Arson Crimew, quoted in a DDoSecrets statement carried by BSS News, said “This dataset is massive in terms of both size and impact.” Her comment speaks to scale, and it matches the 41,000 figure.
Third, Okta’s denial, quoted above, sets the limit of what the vendor will say. Taken together, the three statements show how little common ground exists. The publisher stresses impact, the vendor stresses innocence, and the agency has not been quoted in the coverage reviewed. We will update this report if DHS issues an on-the-record statement.
For readers who want the original reporting, the Washington Post account covers the identification of officers, and the WLRN report offers a shorter summary for a general audience.
Why Undercover and Surveillance Staff Raise the Stakes
Reporting says the data includes personnel connected to surveillance, human intelligence, computer forensics, special operations and undercover work. That list moves the incident out of the ordinary privacy category. A leaked marketing contact list is an annoyance. A leaked list that touches undercover assignments can affect safety and ongoing cases.
We have no way to verify how many records fall into those sensitive categories, and the coverage reviewed does not give a count. We also cannot confirm that every person listed holds the role shown. Any dataset scraped from a directory can carry stale titles, reassigned staff and mislabeled contractors. A wrong record is not harmless, though. A person wrongly flagged as an undercover officer faces the same harassment as one correctly flagged.
For the agencies, the practical problem is containment. Once a searchable copy sits on a public site, mirrors follow. Takedown requests rarely succeed against transparency collectives, and archived copies tend to outlive any single host. The agencies should plan around permanent exposure rather than a temporary one.
Confirmed vs Unconfirmed: A Fact Check
Breaking incidents breed loose claims. The table separates what the reporting supports from what remains open.
| Claim | Status | Basis |
|---|---|---|
| More than 41,000 DHS employees and contractors in the dataset | Reported by multiple outlets | TechCrunch, Washington Post, CBC (rounded to 40,000) |
| DDoSecrets published the data on Oct. 28, 2026 | Reported | Multiple outlets |
| Department of Peace supplied the data | Reported as the group’s claim | Politico and others |
| Access came through DHS’s Okta single-sign-on service | Alleged, disputed by Okta | Hackers’ statement, Okta’s denial of compromise |
| Database is named Icepick | Reported | Press coverage |
| Every listed person is a current DHS employee | Not established | Dataset includes former staff and contractors |
| Every record was independently verified | Not established | No independent audit reported |
| Date and technical details of the intrusion | Unknown | Not disclosed in coverage reviewed |
| Official DHS confirmation or statement | Not found | No quoted DHS statement in coverage reviewed |
The word “identified” in several headlines deserves care. Hackers who say they identified employees have asserted a result, not proved it. Until a neutral party audits a sample of records, the safest reading is that the dataset is large and credible enough to take seriously, but not yet verified end to end.
Historical Context: Government Data Exposures Keep Growing
Icepick is not the first government-linked exposure this year, and it is not the largest by headcount. The table compares it with two incidents we have already covered, using only the figures from those reports. The incidents differ in kind, so the comparison shows scale and data type rather than a ranking of severity.
| Incident | Headline figure | What makes it distinct |
|---|---|---|
| DHS Icepick leak (Oct. 28, 2026) | More than 41,000 employees and contractors | Searchable, names law enforcement roles, alleged SSO route |
| Pentagon data breach suit | 3 million+ people | Lawsuit over a Pentagon data breach |
| Navigate360 hack | 8 million crime tips | Company admitted the hack, with a 7-month figure in the headline |
| TiDB Cloud breach | 28 days of access | Stolen service account rather than a product flaw |
What stands out is not volume. Icepick is smaller than the Pentagon and Navigate360 figures. It stands out because every row is a person tied to an enforcement or security job, and the dataset arrived with a search interface. A smaller, structured, publicly searchable list of officials can do more targeted damage than a larger pile of anonymous records.
Market and Vendor Impact: Identity Providers Under Pressure
None of the coverage reviewed reports a market reaction, so any financial claim here would be guesswork. The more useful question concerns procurement and policy. Federal buyers lean on a small set of identity vendors, and an allegation that touches one of them can prompt questions at the agency level and in oversight hearings.
Our reading, which is analysis rather than reported fact, is that three groups feel the pressure first. Identity vendors will face customer questions about tenant hardening and log retention, whatever the outcome of the Okta dispute. Federal contractors, who appear in the dataset alongside employees, will likely see tighter access reviews. And security-operations teams will revisit how quickly they can spot unusual directory queries.
Authentication standards are part of the picture too. Our guide to OAuth 2.1 and zero-trust authentication shows how short-lived, scoped tokens limit the damage when one credential falls. Directory-wide exposure of 41,000 profiles suggests that something in the chain granted broad read access, and that is the sort of permission scoping those controls aim to prevent.
How Defenders Should Respond This Week
You do not have to work for DHS to learn from this. Any organization that runs single sign-on holds a directory of names, roles and group memberships that looks a lot like Icepick. The list below comes from general identity-security practice, not from any DHS or Okta guidance.
- Audit directory read permissions. Check which administrators, service accounts and integrations can export user lists, group memberships and contact fields. Cut every export right that lacks a named owner.
- Require phishing-resistant MFA for admins. Hardware-backed keys or passkeys for administrator roles close the most common route to a tenant takeover.
- Alert on bulk directory queries. A single account pulling tens of thousands of profiles should page someone. Tune the rule on your own baseline.
- Shorten session lifetimes for privileged tokens. A stolen session token is only useful while it works.
- Plant tripwires. Seed fake accounts and canary records in the directory so a mass export trips an alarm. Our walkthrough of honeypots versus canary tokens covers four free tools to start with.
- Brief staff on impersonation. Tell employees that attackers may now know their manager’s name and group. Verify unusual requests by a second channel.
- Watch for your own data. Set up breach monitoring for company domains, as in our Have I Been Pwned setup guide.
For wider context on how this fits into the threat picture, see our cybersecurity coverage hub, where we track breaches and defensive tooling as they develop.
Predictions: Five Things to Watch
These are our forecasts, not reported facts. We offer them so readers can check our reasoning later.
- DHS will confirm or dispute the dataset within days. A leak this visible makes silence hard to hold. Expect either a statement on the authenticity of the records or a note that an investigation is under way.
- The Okta dispute will turn on configuration, not code. Vendor denials of platform compromise usually coexist with customer-side findings such as stolen credentials or over-broad permissions. A joint finding would settle the argument.
- Phishing aimed at DHS-adjacent staff will rise. Contractors, former employees and partner agencies are soft targets with plausible names to impersonate. Security vendors will likely publish campaign sightings within weeks.
- Federal pressure on identity hardening will grow. Oversight letters or agency directives on administrator authentication and directory export controls are a reasonable next step.
- Mirrors will outlast takedown efforts. Treat the data as permanently public. Defensive planning should assume the records stay searchable.
FAQ: DHS Employee Data Leak and Icepick
How many DHS employees were affected? Reporting puts the dataset at more than 41,000 current and former employees and contractors. Some outlets round to 40,000. About 21,000 records tie to CBP, roughly 10,000 to ICE and HSI combined, and just under 1,000 to CISA.
Who published the data? Distributed Denial of Secrets, known as DDoSecrets, published it on October 28, 2026. The data is attributed to a group calling itself Department of Peace.
What information does the leak contain? Reported fields include names, job titles, work email addresses, phone numbers, office locations or work addresses, and internal group memberships. The confirmed field list does not include home addresses or Social Security numbers.
Was Okta hacked? Not according to Okta. The hackers say they reached the data through a DHS Okta single-sign-on service, while an Okta spokesperson told WIRED the company has no evidence its data or systems were compromised. The full technical path remains unconfirmed.
Has DHS confirmed the breach? The coverage reviewed does not include a quoted DHS statement or a named DHS spokesperson. We will update this article if that changes.
Are all the listed people current DHS employees? No one has established that. The dataset covers current and former staff and contractors, and no independent audit of record accuracy has been reported.
Why does the undercover angle matter? Reporting says the data includes personnel tied to surveillance, human intelligence, computer forensics, special operations and undercover work. Exposure of those roles can raise safety risks and complicate investigations, even if some records are outdated.
What should other organizations do? Review who can export directory data, enforce phishing-resistant MFA for administrators, alert on bulk queries and train staff to verify unexpected requests through a second channel.
