A DHS data breach has placed work records for more than 41,000 Department of Homeland Security employees and contractors in a public archive. Distributed Denial of Secrets published the dataset, which it calls Icepick, on Wednesday, October 28, 2026, after a hacker using the name Department of Peace claimed the files came from a DHS Okta single sign-on tenant. Okta says it has no evidence its data or systems were compromised, and DHS says it is aware of a potential breach.
Key Takeaways
- More than 41,000 DHS employee and contractor records were published online.
- Records include names, work contacts, offices, and application-access groups.
- Actor claims a DHS Okta tenant; Okta reports no evidence its data or systems were compromised.
- DHS says it is aware of a potential breach and is responding.
What the DHS Data Breach Includes
According to SecurityWeek’s account, the records include names, work email addresses and phone numbers, job titles, office locations, and which systems and internal applications each account can access. WIRED’s review found the files were last updated on August 19, 2026, and cover DHS plus seven component agencies. TechCrunch matched several known employees against an offline copy and said timestamps point to exfiltration around mid-August.
The archive is not a complete directory. DDoSecrets cofounder Emma Best said, as quoted by CNBC: “Rather than an indiscriminate directory of every DHS employee, Icepick identifies many of the architects and drivers of DHS policy and operations.” A note left with the files said, “They have our information, so it’s only fair that we have theirs.”
Component Counts Reported by Outlets
Reporters who examined the set published different component totals. The figures below are those tallies, not an official DHS census.
| Component | Reported scale | Outlet |
|---|---|---|
| CBP | Some 21,000 records | TechCrunch |
| CBP | More than half the records | WIRED |
| ICE | About 10,000; roughly a third in HSI | WIRED |
| ICE and HSI | Another 10,000 combined | TechCrunch |
| USCIS | 6,200 | WIRED |
| CISA | Nearly 1,000; more than half contractors | WIRED |
TechCrunch described CISA as just under 1,000 people, and SecurityWeek said roughly 1,000. TechCrunch put the full set at about one-fifth of a workforce around 220,000; WIRED said about a seventh.
Okta’s Denial and the Access-Group Risk
An Okta spokesperson told SecurityWeek, “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised.” DHS told SecurityWeek, “DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”
That vendor statement does not establish that the customer tenant is intact. The actor claims a DHS Okta system used by employees and contractors. TechCrunch reported the hacker did not respond to questions about how the breach was carried out. As analysis, identity teams should scrutinize the customer SSO tenant, not only the vendor cloud, until DHS says more.
“The most concerning part of this breach is the access information that came with it. If an attacker knows which employees have access to which systems and applications, they’ve essentially been handed a roadmap for where to go next and who to target to get there,” Illumio public sector CTO Gary Barlet told SecurityWeek.
WIRED counted over 55,000 permission-group names and found that nearly everyone named has access to at least some of those systems. Most employees in the set belonged to a Microsoft 365 group, TechCrunch reported, with other groups for Adobe Acrobat and Citrix. WIRED found names that appear to reference Palantir’s Falcon and PenLink, plus groups tied to certified undercover operations and intercept programs. More than 200 CBP accounts were tied to the face-recognition app Mobile Fortify.
TechCrunch found around 4,500 users, including ICE agents and deportation officers, in a group called “Headspace_users.” Headspace told TechCrunch it has not provided any services to DHS or ICE since 2023. TechCrunch reported an $82,500 ICE contract that ended that year.
Where This Sits Among Federal Personnel Leaks
SecurityWeek noted the leak surfaced one month after extortion group ShinyHunters breached FBI systems and three months after a hack of the Homeland Security Information Network. WIRED reported ShinyHunters claimed data on nearly every FBI employee and their families. Separately, TechCrunch said Department of Peace, the same hacker as this leak, earlier claimed to have taken thousands of contracts between DHS and the private sector, including defense contractors and surveillance vendors.
What Security Teams Should Assume
The steps below are analysis for identity and security leaders, not findings from the DHS inquiry.
- Assume published work emails and phone numbers will be reused in phishing and vishing.
- Treat app-assignment and group-membership exports as sensitive security data.
- Hunt stale vendor groups; the Headspace membership shows how they linger after a contract ends.
- Review contractor and partner accounts that share an employee single sign-on tenant.
- Do not read a vendor denial about its data or systems as proof the customer tenant is clean.
Leslie, of Recorded Future, told WIRED the data grows more useful when matched to prior breaches and commercial data, including for impersonation attempts.
