A hacktivist group calling itself the Department of Peace says it took personnel records on more than 41,000 employees and contractors of the US Department of Homeland Security, and the data is now public. The transparency group Distributed Denial of Secrets published the archive, which it calls “Icepick,” on October 28, 2026, and a researcher built a searchable database of it. DHS said it was “aware of a potential breach and is actively working to address the situation swiftly and effectively.”
The records include names, offices, work contact details and job assignments. According to reporting by NPR and WIRED, they also reference undercover and surveillance programs and the people who staff them. For any organization that holds employee directories in a cloud identity system, the incident is a stark example of how much a “low-sensitivity” staff list can reveal once it leaves the building.
What is known
Distributed Denial of Secrets describes the data as an internal database from an Okta single sign-on service used by DHS, identifying more than 41,000 people by name, office, contact information and assignment. The Department of Peace gave copies to DDoSecrets and to the Swiss hacktivist and researcher maia arson crimew, who built the search tool. NPR reported that the group said it obtained the data by subverting DHS’s single sign-on system, and that a US journalist was also given the data.
Several outlets checked parts of it. Reuters reported that three DHS employees in the leak confirmed their names and contact details were genuine. WIRED, which previewed the data, said the records span DHS and seven component agencies and were last updated on August 19, 2026.
On the breakdown, sources differ slightly. WIRED counted CBP staff as more than half the records, about 10,000 for ICE including Homeland Security Investigations, about 6,200 for Citizenship and Immigration Services, and nearly 1,000 tied to CISA, more than half of them contractors. The Icepick site itself lists over 21,000 CBP identities, nearly 6,600 from ICE, 1,755 from DHS headquarters and 980 from CISA. NPR put the total at about a fifth of DHS’s workforce; WIRED said about a seventh. The differences likely reflect how contractors and sub-agencies are counted.
What is not known
- How access was gained. The hackers say they subverted DHS’s single sign-on. Okta told WIRED it was unaware of any breach of its systems and had “no evidence our data or systems were compromised.” Those statements can both be true if a DHS account or configuration, rather than Okta’s platform, was the weak point.
- The full scope. The site says it is “not a comprehensive list of all DHS employees” and that inaccuracies in the source data may be reproduced.
- DHS’s findings. The department has not said what its investigation has found, how long the access lasted, or whether other data was taken.
Why a staff directory is sensitive
On their own, names, work phones and office addresses look like directory data. Combined with assignments and program names, they become something else. The leak reportedly identifies officials overseeing covert operations and people linked to surveillance tools, and it maps how DHS is organized from leadership down to individual agents. For people in sensitive roles, exposure creates risks of harassment, doxxing and targeting of family members, and it can compromise ongoing operations.
The hacktivists made their motive plain. In a note with the files, they wrote: “They have our information, so it’s only fair that we have theirs.” DDoSecrets co-founder Emma Best said the aim was to replace “anonymity with accountability.” Whatever one thinks of that argument, the effect for the people named is the same, and it does not depend on whether any one record is accurate.
The US already recognizes this risk in other settings. New Jersey’s Daniel’s Law lets judges, police and other covered people demand removal of their home addresses and phone numbers from public listings, and courts have strengthened it, as we reported in our story on the New Jersey Supreme Court’s Daniel’s Law ruling. A leak like Icepick bypasses those protections entirely, and once leaked records are copied into people-search sites and broker files, getting them removed becomes much harder, a problem we explored in hidden opt-out pages and massive breaches.
A pattern of government data exposure
The leak follows other recent incidents involving US agencies, including attacks on the FBI that NPR mentioned. It also comes against a background of uneven federal cloud security. We covered an inspector general’s finding that most civilian agencies missed CISA’s cloud security order in our report on the DHS watchdog’s review. Leaked surveillance files have exposed sensitive networks before, as in the case we examined in a leak of surveillance tracking files.
Five lessons for any organization using single sign-on
Few companies face hacktivists targeting their staff lists. But nearly every company uses an identity provider that holds a full directory of employees, contractors, roles and group memberships. That directory is a high-value target.
- Treat the identity directory as sensitive data. Classify it, limit who can export it, and log bulk reads. Group names and descriptions often reveal more than intended.
- Harden administrative access. Require phishing-resistant multi-factor authentication for administrators and service accounts, and review API tokens with directory read rights.
- Watch for unusual queries. Alert on large directory pulls, new integrations and access from unfamiliar locations.
- Minimize what the directory holds. Remove stale accounts, avoid putting sensitive project names in group titles, and do not store home details where work details will do.
- Plan for staff-data incidents. Have a process to notify affected employees, support people at risk of harassment, and handle takedown requests. Our guide to breach prevention best practices covers the basics.
Captain Compliance works with privacy and legal teams on incident response planning and the records that show what personal data each system holds. Neither replaces identity security controls, but both shorten the time between “we have a problem” and knowing who is affected.
Frequently asked questions
Did DHS confirm the breach?
DHS said it was aware of a potential breach and was working to address it. Reporters confirmed that some records were genuine with individual employees.
Was Okta hacked?
Okta said it had no evidence its systems or data were compromised. The hackers say they subverted DHS’s single sign-on. The point of failure has not been publicly established.
What data was exposed?
Names, offices, work contact information and assignments for more than 41,000 people, plus references to internal systems and programs, according to DDoSecrets and media reports.
Is it legal to search the database?
Publication of leaked material raises complex legal questions that depend on jurisdiction and use. Organizations should get legal advice before staff access it, and should not use it to make decisions about individuals.
DHS holds vast amounts of data on travelers and residents. This week, about 41,000 of its own people learned what it is like to be on the other side of a database. The department’s response will show whether it treats them the way privacy law expects organizations to treat anyone whose data has leaked: with notice, support and a clear account of what went wrong.
