A leak site run by Distributed Denial of Secrets (DDoSecrets) published records on more than 40,000 U.S. Department of Homeland Security employees and contractors on October 28, 2026. The BBC reported that the release exposes details of thousands of immigration agents, and other outlets put the total at more than 41,000 people. This DHS employee data leak, packaged in a database called Icepick, ranks among the largest exposures of federal personnel contact data in recent memory.
The fields look mundane: names, job titles, work email addresses, phone numbers and office locations. The context is not. The records span Customs and Border Protection, Immigration and Customs Enforcement, Homeland Security Investigations, the Cybersecurity and Infrastructure Security Agency and the Federal Protective Service. Job titles and email groups in the data point to special operations, surveillance, computer forensics and undercover work.
This analysis walks through what is confirmed, what is still disputed, how the Icepick leak compares with other 2026 incidents, and what security teams should do next. Another recent case, the Navigate360 breach that exposed 8 million crime tips, showed how long sensitive public-safety data can sit exposed before anyone notices. Icepick adds a harder problem: the data describes people, not tips.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What DDoSecrets Published on October 28
DDoSecrets posted the Icepick database to its own website on October 28, 2026. A wire report carried by U.S. News described the release as data on tens of thousands of Homeland Security employees. The group named Department of Peace as the source of the material.
Emma Best, a co-founder of DDoSecrets, said the hacker known as maia arson crimew built a search tool for the data. That detail matters for impact. A raw dump of tens of thousands of rows stays a niche file. A searchable interface turns it into something a reporter, a researcher or a hostile actor can query in seconds.
The reporting I reviewed does not include a DHS statement on the authenticity of the records, and this article does not claim the data is complete or current. What the outlets agree on is the date, the publisher, the database name and the general shape of the contents.
The Numbers: 40,000, 41,000 or More?
Headlines differ on the count. CyberScoop reported more than 41,000 DHS employees, and WIRED used the same figure in its headline. The Verge wrote that more than 40,000 records were stolen. The gap likely reflects counting methods, since the dataset covers both employees and contractors and some people may appear more than once. No source in the fact base resolves that question, so the safest framing is “more than 40,000.”
The agency split is easier to pin down. Reports put more than 21,000 records on CBP personnel. The BBC counted nearly 6,600 for ICE, while another report described about 10,000 records tied to ICE and HSI together. That report also placed roughly 1,000 records at CISA.
| Component | Reported records | Source basis |
|---|---|---|
| Total dataset | More than 40,000 to more than 41,000 | Verge, BBC, WIRED, CyberScoop (counts differ) |
| CBP | More than 21,000 | BBC and other reports |
| ICE | Nearly 6,600 | BBC |
| ICE and HSI combined | About 10,000 | Separate report |
| CISA | About 1,000 | Separate report |
| Federal Protective Service | Present, no count reported | Multiple reports |
Note that the component figures do not need to add up to the total. HSI, the Federal Protective Service and other offices fill the remainder, and the sources do not break those out.
What the Icepick Records Contain
Per the reporting, each entry carries a name, job title, work email address, phone number and office location. On their own, those fields resemble an internal staff directory. Directories leak all the time, and most are low value.
The difference here is classification by function. Job titles and email groups in the data indicate assignments in special operations, surveillance, computer forensics and undercover work. A reader can filter the list by role and see who sits in which unit. That turns a phone book into an organizational chart of enforcement and investigative capacity.
Fields Reported in the Release
- Full names of employees and contractors
- Job titles, including roles tied to surveillance and forensics
- Work email addresses and email group memberships
- Work phone numbers
- Office locations
No outlet in the fact base reports home addresses, Social Security numbers or financial data in the set. Treat any claim about those fields as unverified until a named outlet confirms it.
Which Agencies Are in the Data
CBP dominates by volume, which makes it the biggest slice by far in the reporting. ICE and HSI follow, and the reporting treats them as closely related populations. CISA is the smallest named group, with about 1,000 records, but it is the most interesting one for the security community. CISA staff run vulnerability coordination and publish the known-exploited-vulnerabilities catalog that many defenders rely on. Our guide to EPSS, CVSS and CISA KEV triage shows how much patch prioritization leans on that agency’s output.
The Federal Protective Service also appears. It guards federal buildings, so exposed office locations and contact details raise a physical-security question that a pure data-privacy lens misses.
Department of Peace and the Unconfirmed Okta Claim
DDoSecrets credited a source it calls Department of Peace. Reports differ slightly in wording. Some say the group claimed responsibility, others say it was identified as the source. Either way, the public record does not establish who originally obtained the data or how.
One allegation circulated in coverage: that the data came from abusing Okta’s single sign-on service. The reporting presents this as a claim, not an established finding, and it carries no confirmation from Okta or DHS in the sources reviewed. Readers should hold it loosely.
Still, the claim points at a pattern defenders know well. Identity infrastructure is a single choke point, and one stolen credential can unlock a directory-sized prize. We saw a similar shape in the TiDB Cloud breach, where a stolen service account stayed live for 28 days. Whether Okta played any role in Icepick remains open.
Why Role Data Matters More Than a Name List
Security teams usually rank a leak by the sensitivity of each field. Icepick shows why that habit misleads. The sensitive part is the combination of an identity with a function.
Targeting and Social Engineering Risk
A verified work email plus a job title plus a phone number is the raw material for spear phishing. An attacker no longer has to guess who works on surveillance tooling or forensics. The list says so. Criminal groups and foreign intelligence services can use the same search tool as journalists.
Personal Safety Risk
Reports that the data includes personnel tied to undercover work raise the stakes beyond cyber risk. Work phone numbers and office locations can lead to home and family exposure through ordinary open-source research. I am not naming or pointing to any individual in this article, and neither should anyone else reproducing the story.
What Emma Best and maia arson crimew Say
The publishers framed the release as accountability journalism. The BBC reported Best describing the goal as “Anonymity with accountability.” The Verge covered the same release under a headline about a hacker stealing the records, which shows how differently the story reads depending on who tells it.
Best also argued in comments carried by Techdirt that the data is targeted rather than random: “Rather than an indiscriminate directory of every DHS employee, Icepick identifies many of the architects and drivers of DHS policy and operations.” In the same Techdirt piece, Best said the leak identifies “the officials responsible for overseeing covert and undercover operations.”
The hacker maia arson crimew, who developed the search tool, told the outlet SAN: “This dataset is massive in terms of both size and impact.” Separately, a published statement described the data as an unprecedented look at DHS’s organizational structure, showing who does what work across agencies including ICE. The sources attribute that line differently, so I paraphrase it here rather than quote it.
The framing creates a clear tension. Best says the release is selective. The reported scale of more than 40,000 people suggests a very broad net. Readers can judge for themselves, but both claims cannot fully hold at once.
Historical Context: Hacktivist Leak Sites and Government Data
DDoSecrets has published hacked and leaked datasets for years, and Best’s own comments in the Techdirt report reference the earlier BlueLeaks episode and the government’s hunt for leakers. The group operates as a transparency collective, not a criminal marketplace. That distinction shapes how platforms, press and prosecutors treat its releases.
Icepick differs from earlier public-sector leaks in one way: the unit of publication is the employee. Many past dumps exposed documents, emails or case files. Here the personnel roster is the story. That puts it closer to a doxxing-adjacent release than to a document cache, and the debate over where journalism ends and targeting begins will follow it.
How Icepick Compares With Other 2026 Incidents
Our archive gives a useful yardstick. The table compares Icepick with other incidents we covered this year, using the figures in those articles.
| Incident | Scale reported | Data type | Status of claim |
|---|---|---|---|
| Icepick (DHS) | 40,000 to 41,000+ people | Work contact details and roles | Published by DDoSecrets, origin unconfirmed |
| Navigate360 / P3 Global Intel | 8 million crime tips | Tip submissions | Company admitted hack, 7 months |
| Bithumb and Daishin | 38,490 customers | Customer data | Breach reported |
| Capcom ID | 11.77M breach | Capcom ID data, 196 password resets | Analysis of reported breach |
| TiDB Cloud | 28 days of access | Cloud environment | Stolen service account |
| Coinbase | 70,000-user claim | Contact data | No breach, claim unconfirmed |
Icepick sits near the Bithumb and Daishin breach that hit 38,490 customers in raw headcount. The difference is who the people are. Customers lose money or privacy. Federal agents and analysts may lose operational cover.
Capcom’s incident is the opposite case. The Capcom ID analysis of 196 password resets against an 11.77M-account breach shows a far larger population. Icepick has fewer people but a sharper risk profile per person.
Market and Industry Impact
Three groups will feel this first. Identity vendors face renewed scrutiny if the Okta allegation gains support. Even an unproven claim pushes federal buyers to ask harder questions about single sign-on configuration, session lifetimes and phishing-resistant authentication.
Federal contractors come next. The dataset includes contractors, and contract language on data handling and breach notice tends to tighten after incidents like this. Expect procurement officers to ask vendors how staff directories are exposed and who can export them.
Security awareness and threat-intelligence vendors form the third group. They can sell monitoring for leaked employee data, executive protection and identity exposure. Our broader cybersecurity coverage tracks how these services evolve. None of this is a market sizing claim. It is a read on where budget conversations will go.
What Defenders and Employers Should Do Now
The advice below applies to any organization whose staff directory could end up in a similar dump, not only DHS.
- Assume work emails and phone numbers of exposed staff are now in attacker hands, and warn those staff about targeted phishing and vishing.
- Move high-risk roles to phishing-resistant sign-in such as hardware security keys.
- Audit who can export directory data from identity and email systems, and log every export.
- Shorten session lifetimes for single sign-on and review service accounts with broad scope.
- Use breach-monitoring services so staff learn quickly when their addresses surface. Our Have I Been Pwned setup guide covers the free route in 13 steps.
- Brief physical security teams about exposed office locations.
Individuals who think they appear in the set should treat unexpected messages as suspect, rotate passwords, and avoid reusing work details on personal accounts.
Lessons on Directory Exposure for Every Large Employer
Most companies treat the internal directory as low-risk. Icepick argues otherwise. A directory shows reporting lines, team names and who answers which mailbox. Attackers use that map to pick the right person for a convincing lie, and they pick fast when a search tool does the filtering for them.
Large employers can cut that exposure in three ways. First, split directory views so that contractors and general staff cannot browse every unit. Second, strip role-revealing email group names from anything that leaves the identity system. Third, alert on bulk reads of the directory, since a dump of 40,000 rows rarely looks like normal traffic. None of these steps stops a determined intruder with a valid session, but each raises the cost and shortens the window.
The Icepick story also shows why detection speed matters. Reports about the dataset give no timeline for when the records were taken. If the gap between theft and publication ran long, defenders had no chance to rotate anything. Short-lived credentials and fast offboarding limit what a stale copy of a directory can do.
Legal and Policy Questions
The release raises questions the sources do not answer. Who, if anyone, faces charges for obtaining the data? Do platforms and hosting providers act on takedown demands? Does DHS notify affected staff? The reporting reviewed here offers no confirmed answers, and this article does not assert any legal status for anyone involved.
Congressional and inspector-general interest seems likely given the agencies involved, but that is an expectation, not a reported fact. Watch for official statements on notification, credential resets and any review of identity systems.
Confirmed Versus Unconfirmed
| Claim | Status | Note |
|---|---|---|
| DDoSecrets released the data on October 28, 2026 | Confirmed | Reported across outlets |
| Database is named Icepick | Confirmed | BBC and others |
| More than 40,000 to 41,000 people covered | Confirmed range | Exact figure not settled |
| Fields: names, titles, emails, phones, offices | Confirmed | Per multiple reports |
| Agencies include CBP, ICE, HSI, CISA, FPS | Confirmed | Counts vary by outlet |
| Department of Peace is the stated source | Confirmed as claim | Original actor not independently identified |
| Okta single sign-on was exploited | Unconfirmed | Allegation only |
| Exact number of affected people | Unconfirmed | Counts range 40,000 to 41,000+ |
Five Predictions for the Next 90 Days
These are analyst judgments, not reported facts.
- The headcount will get refined. Expect a firmer figure once researchers deduplicate employees and contractors, probably within weeks.
- Targeted phishing will follow. Security vendors will likely report campaigns that use the exposed names and email groups as lures.
- The Okta question will resolve in either direction. A statement or forensic finding should confirm or kill the claim, and either result will move identity-security conversations.
- Federal identity rules will tighten. Agencies are likely to push stricter authentication and directory-export controls.
- Mirror and takedown fights will grow. Copies of the dataset will spread, and hosting and platform decisions will become a story of their own.
FAQ
What is the Icepick DHS leak?
Icepick is a database published by Distributed Denial of Secrets on October 28, 2026. It holds contact and role data on more than 40,000 DHS employees and contractors.
How many DHS employees are affected?
Outlets report more than 40,000 or more than 41,000. The exact number is not confirmed.
What information is in the leak?
Names, job titles, work email addresses, phone numbers and office locations, plus email groups that indicate roles such as surveillance and undercover work.
Which agencies are included?
CBP, ICE, HSI, CISA and the Federal Protective Service. Reports put CBP at more than 21,000 records and ICE at nearly 6,600 per the BBC.
Who obtained the data?
DDoSecrets named a source called Department of Peace. The original actor and method are not independently confirmed.
Was Okta breached?
One report alleged the data came from exploiting Okta’s single sign-on service. That remains an unconfirmed allegation.
What should affected staff do?
Treat unexpected emails and calls as suspect, rotate credentials, use hardware security keys where possible, and follow guidance from their agency’s security office.
