The DHS Icepick Leak: What 41,000 Exposed Staff Records Mean for Identity Security

On October 28, 2026, the transparency collective Distributed Denial of Secrets (DDoSecrets) published "Icepick," a searchable archive of work records for 41,191 Department of Homeland Security employees and contractors. The records include names, job titles, offices, work email addresses, work phone numbers, managers and internal group memberships. A hacktivist group calling itself the "Department of Peace" says it pulled the data from the Okta single sign-on service DHS uses. Okta says it has no evidence its systems were compromised, and DHS has called it "a potential breach."

If you work at DHS or one of its contractors, assume your work identity and reporting line are now public, and expect targeted phishing and phone pretexting that uses them. If you run identity for any large organization, this is the incident to study this quarter. It is not about passwords. It is about what your identity directory says about your people.

What happened

DDoSecrets released the dataset on October 28. Decrypt reported the totals: 41,191 people, 21,329 of them at Customs and Border Protection (CBP), and more than 55,000 internal permission groups. The newest records date to August 19, 2026, so this is a snapshot, not a live feed.

TechCrunch described the haul as over 40,000 user account records from Homeland Security's login system, with work-issued phone numbers and email addresses. DDoSecrets co-founder Emma Best told TechCrunch the dataset contains professional contact information, and no home addresses or personal contact details.

WIRED, which previewed the data, broke it down further, as summarized by The Next Web. It counted about 10,000 Immigration and Customs Enforcement (ICE) records, about 6,200 at US Citizenship and Immigration Services, and nearly 1,000 at CISA, more than half of them contractors. Group names reference investigative and AI tools, and WIRED reported that some investigators sit in groups associated with undercover work, which is the most dangerous part of the exposure.

The group behind the leak framed it as political. Its spokesperson cited DHS Secretary Markwayne Mullin's July 17 pledge about "turning up the heat" on ICE operations. "They have our information, so it's only fair that we have theirs," the spokesperson added. The same group name was attached to a March 2026 claim against the DHS Office of Industry Partnership, which exposed contract data for more than 6,000 companies. That is a separate incident, and nothing public links the two technically.

DHS has said little. "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively," a spokesperson said, in the only statement so far. DHS then filed a takedown notice through ZeroFox, a security vendor authorized to act for the department until 2028. The notice asked the domain registrar to "stop serving the personal contact and location data of individuals who did not consent to its publication." The registrar, CentralNic, put the search site's domain on hold. CyberScoop reported that the host, FlokiNET, refused ZeroFox's request, and the site came back under a different registrar. Bluesky now blocks links to the archive.

What we know and what we don't

Question	Status as of October 30, 2026
Was data published?	Yes. DDoSecrets published Icepick on October 28.
How many people?	41,191 per Decrypt; "over 40,000" per TechCrunch. DHS has not confirmed a number.
What fields?	Name, title, office, work email, work phone, manager, group memberships. No home addresses, per DDoSecrets.
Is it authentic?	Partly corroborated. Reuters matched details for six named employees and reached three by phone. The full archive is unverified.
How was it taken?	Unproven. The source group claims DHS's Okta sign-on service. Okta says it has no evidence of compromise. DHS has not described a method.
How many ICE records?	Disputed. WIRED counted about 10,000; BBC counted nearly 6,600.
Is it current?	Partly. Newest records are from August 19, and Nextgov found some former CISA staff listed.
Were classified systems touched?	Nothing public suggests it.

This is not a business card leak

Defenders of the release argue that names, titles and work phones are business card information. For any single record, that is roughly right. Adam Steinbaugh of FIRE told WIRED as much, and the legal point is his to make.

The security point is different. A business card does not list your manager, and it does not list your group memberships. Put 41,000 cards side by side with reporting lines and you have an org chart. Add 55,000 permission groups and you have an entitlement map: who can reach which system, who sits in which program, and which tools each team uses.

Group memberships are the part I would worry about most. In an identity provider, groups exist to grant access, so their names describe what they unlock. A group named after a wiretap program or an undercover designation is a label pinned to every member. Membership does not prove someone does that work. It does tell an adversary where to look first.

Alexander Leslie of Recorded Future made the same point, according to The Next Web: if the data is authentic and current, it is a valuable intelligence resource for adversaries trying to penetrate DHS. I agree, and I would add the obvious next step. Reuters matched employees to credit bureau and breach data. That join is now trivial for anyone, including foreign services and criminals.

What the Okta claim does and does not mean

Read Okta's statement carefully: "Okta is secure, and we have no evidence our data or systems were compromised." That can be completely true while the hackers' claim is also partly true. An identity provider serves each customer's directory through that customer's own tenant. If someone obtained a valid DHS account, session or API token with directory read rights, they could export users and groups without touching Okta's own infrastructure.

I am not saying that is what happened. Nobody has shown how the data was taken, and the claim comes from the people who took it. I am saying that "the vendor was not breached" and "the customer's tenant was not misused" are different questions. Security teams should stop treating the first as an answer to the second. Okta has been on the wrong end of an identity story before, in the 2022 Lapsus$ incident, and the lesson then was the same: the shared responsibility line is where attackers look.

A few facts point toward an export rather than a live intrusion. The records stop on a single date. They include group memberships, which a directory export carries and a phished inbox does not. Some entries are for people who have since left. None of that proves a method. It does tell me which logs I would pull first if this were my tenant.

Lessons for enterprise security teams

You do not need to be a federal agency for this to apply. Every company with a central identity provider has the same three assets in one place: a people directory, a reporting graph and an entitlement graph. Here is what I would change this month.

1. Classify the directory as sensitive data. Most data classification schemes protect customer records and ignore the employee directory. Treat a full user and group export like a customer database export, with the same approvals and alerts.
2. Restrict who can enumerate users and groups. Audit which admin roles, service accounts and API tokens can list the whole directory. Most integrations need a scoped subset. Remove the rest.
3. Alert on bulk directory reads. An account that pages through tens of thousands of users in a day is behaving unlike any human. Identity threat detection and response (ITDR, monitoring the identity layer itself for attacks) should flag it.
4. Name sensitive groups opaquely. A group name is metadata that travels with every export. For programs whose existence or membership is sensitive, use neutral identifiers and keep the meaning in a separate, restricted register.
5. Put contractors on the same lifecycle as staff. More than half of the CISA records were contractors, per WIRED. Contractor accounts are where stale access and loose ownership collect. Tie each one to a sponsor and an end date.
6. Harden the help desk now, not after. A leaked org chart is a pretexting kit. An attacker who knows your manager's name and your team can call IT as you. I covered why in your help desk is the new perimeter, and the reset flow is often the real ceiling, as I argued in account recovery design.
7. Rehearse the "our org chart is public" scenario. Run a tabletop where your directory leaks tomorrow. Decide who warns staff, what the warning says, and how verification on calls changes for the next 90 days.

What affected DHS staff and contractors should do

The fields reported are work identifiers, not Social Security numbers or bank details, so classic identity theft is not the main risk. Targeted social engineering is. Practical steps:

• Treat any call or message that names your supervisor as unverified. The leak hands attackers your reporting line. Call back on a number you already have, never the one in the message. The senior official voice impersonation entry in Scam Atlas shows how this pattern plays out.
• Expect fake IT and password reset requests. The help desk reset impersonation pattern runs in both directions: attackers pose as IT to you, and as you to IT.
• Report suspicious contact to your agency or company security office first. Your security team needs the pattern, not just the single message. CISA's guidance on recognizing and reporting phishing covers the basics, and fraud attempts can be reported to the FBI at ic3.gov.
• Shrink what can be joined to the leak. Your work record is now public. Your home address and personal phone probably sit on people search sites already. My free data broker exposure check estimates how large that profile is and links to opt-out pages.
• Lock down personal accounts tied to your name. Use passkeys or an authenticator app where you can, and set a carrier PIN against SIM swaps.

What I expect next

These are my predictions, not reported facts.

Oversight letters will arrive. I have found no congressional letter or inspector general statement yet. Given the size of the release and the ICE angle, I expect both parties on the homeland security committees to ask DHS how the data left and whether the identity provider was involved.

The method question will land on the customer side. If DHS confirms a cause, I expect it to involve tenant configuration, a token or an account, not a flaw in Okta's platform. That outcome would push federal buyers to demand directory read telemetry and export controls by default, not as add-ons.

Takedowns will not work. The search site was back under a new registrar within a day, and DDoSecrets offers the files for download. Once a directory is mirrored, the only defense left is changing how people verify each other.

The doxxing debate will absorb the security lesson. Most coverage will argue about whether publishing federal agents' work details is accountability or endangerment. That is a real debate. For security teams, it is a distraction from the plain finding: one directory export can describe a 41,000 person organization.

After more than 15 years in identity and security, my view is simple. Organizations protect authentication well and treat the directory behind it as plumbing. Icepick shows that the directory is the asset.

FAQ

What is the DHS Icepick leak?

Icepick is an archive published by DDoSecrets on October 28, 2026, containing work records for about 41,000 DHS employees and contractors. Records include names, titles, offices, work emails, work phones, managers and permission group memberships. A group calling itself the Department of Peace claimed it took the data.

Was Okta hacked in the DHS leak?

There is no evidence of that. The group behind the leak claims the data came from the Okta sign-on service DHS uses. Okta said it has no evidence its data or systems were compromised, and Reuters could not corroborate the claim. A misused customer account or token would not require a breach of Okta itself.

Did the Icepick leak include home addresses or Social Security numbers?

No such fields have been reported. DDoSecrets says the dataset has no home addresses or personal contact details, and TechCrunch described the phone numbers as work-issued. The risk is that the work data can be joined with broker and breach data to find more.

What should DHS employees do after the leak?

Treat calls and messages that cite your manager or team as unverified, and confirm through a known channel. Report suspicious contact to your security office. Reduce your personal exposure on people search sites, and protect personal accounts with passkeys and a carrier PIN.

What should companies learn from the DHS leak?

Treat the identity directory as sensitive data. Limit which accounts and tokens can enumerate users and groups, alert on bulk directory reads, name sensitive groups opaquely, and keep contractors on a strict lifecycle. Then harden help desk verification, because a leaked org chart is a pretexting kit.

Sources

• Distributed Denial of Secrets release announcement (Oct 28, 2026), deliberately not linked: it leads to the leaked personal records.
• Decrypt: Hackers publish work details of 41,000 Homeland Security employees (Oct 2026)
• TechCrunch: Bluesky blocks links to leaked DHS employee data as government seeks takedowns (Oct 29, 2026)
• CyberScoop: Leaked DHS employee archive, Icepick, faces challenges to stay online (Oct 29, 2026)
• The Next Web: Leak exposes 41,000 Homeland Security staff, summarizing WIRED, Reuters, BBC and Nextgov reporting (Oct 29, 2026)
• TechCrunch: Hacktivists claim to have hacked Homeland Security to release ICE contract data (Mar 2, 2026)