DHS Data Breach: 41,000 Staff Exposed in 'Icepick' Leak

Most data breaches expose customers. This one exposed the people who enforce the border. On 28 October 2026, the transparency collective DDoSecrets published a dataset, labelled "Icepick", on more than 41,000 employees of the US Department of Homeland Security, according to reporting from CyberScoop and Decrypt. It is an unusual and politically charged breach, and it is easy to confuse with another recent one, so it is worth being precise about exactly what happened.

What happened in the DHS data breach?

A hacktivist group calling itself the Department of Peace obtained a large internal dataset of DHS personnel and handed it to DDoSecrets, a collective known for hosting leaked and hacked document sets in the public interest, which published it on 28 October 2026. A hacktivist known as maia arson crimew built a searchable tool around the data, which was taken offline within about a day.

By component, the roughly 41,191 records break down as:

• Customs and Border Protection (CBP): about 21,329, the bulk of the set
• Immigration and Customs Enforcement (ICE): about 6,600 (WIRED, folding in HSI, counts closer to 10,000)
• Homeland Security Investigations (HSI): about 3,421
• Cybersecurity and Infrastructure Security Agency (CISA): about 980

How large a share of DHS that is depends on the workforce figure used, and it is disputed: WIRED, which previewed the data, called it about a seventh of the department; against DHS's own figure of 260,000-plus employees it is closer to a sixth. The "one in five" framing only holds against the lower (~220,000) headcount some outlets cite, so treat the proportion cautiously. Reuters reported that it was able to partially verify the data, matching several named employees to other records and reaching a few who confirmed their details, while noting it could not verify the full archive.

What information was leaked?

Based on current reporting, the exposed records reportedly include:

• Full names of DHS employees and contractors
• Work email addresses and phone numbers
• Job titles and roles, and reporting manager
• Office locations and assignment details
• Internal organisational structure, including tens of thousands of internal permission or access groups

One detail is genuinely contested. DDoSecrets co-founder Emma Best is reported to have said the published set carries work contact details but no home addresses, while some outlets' summaries referred more loosely to "addresses." Treat the presence of home addresses as disputed rather than settled. Either way, this is a leak built to expose the structure and staffing of an enforcement agency, and for staff whose work depends on not being identifiable, the exposure of names, roles and assignments is itself significant.

Who leaked the DHS data?

The data was published by DDoSecrets, but the collective is the publisher, not the group that obtained it. Reporting attributes the breach itself to the hacktivist group Department of Peace, acting on political motives tied to intensifying immigration enforcement, and framing the release as replacing anonymity with accountability for the officials who run those operations. As with the collective's past releases, DDoSecrets' role is to host and distribute material it did not itself steal.

This is squarely political hacktivism rather than financially motivated crime: there is no ransom demand and no sale on a criminal market, the aim is exposure. That framing matters for understanding both the motive and the likely response.

How did hackers get the data, and was Okta breached?

The Department of Peace claims the data came from a compromised single-sign-on (SSO) service used at DHS, the identity layer that lets staff log in to many internal systems with one set of credentials, and it named the identity provider Okta in that chain.

Here precision is essential. Okta has publicly stated that its own systems were not compromised: "Okta is secure, and we have no evidence our data or systems were compromised." A compromise that runs through an organisation's SSO environment is not the same as the identity vendor being breached, Reuters said it could not corroborate the claimed route, and the access path has not been independently established. Do not read "SSO was involved" as "Okta was hacked." Treat the mechanism as the attackers' claim, not confirmed fact, the kind of identity-layer exposure we examined in the context of supply-chain breaches.

Were undercover agents exposed?

This is the most serious dimension of the leak, and the one to state most carefully. The dataset's own role fields are reported to designate staff in covert, undercover and surveillance functions, and DDoSecrets framed the release as identifying those who oversee such operations. If accurate, exposing the identities, roles and assignments of personnel who rely on not being publicly identifiable carries real operational and personal-safety consequences that an ordinary corporate breach does not.

The honest caveat is that this rests on the dataset's own labelling and the publisher's framing, not on independent confirmation that specific named people are active covert officers. It is the claim most likely to be amplified or distorted, so it deserves the firmest sourcing rather than repetition.

How this differs from the Pentagon DMDC breach

It is easy to blur two recent incidents, so keep them separate:

• This DHS "Icepick" leak: a hacktivist group obtained DHS employee directory records (names, work contacts, roles, assignments) and DDoSecrets published them to expose the agency. Motive: political transparency. No Social Security numbers reported.
• The earlier Pentagon DMDC breach: a data exposure centred on Social Security numbers and identifiers of more than three million military-affiliated people. Different victims, different data, different actor.

They are not the same story, and conflating them overstates what either one exposed. This is a workforce-exposure leak by activists; the DMDC case was an SSN-centric breach.

What affected DHS staff and the public should take from it

For anyone potentially in the dataset, the practical steps are the ordinary ones after any workforce leak: expect a rise in targeted phishing and impersonation using real names and roles, be sceptical of unsolicited contact that cites accurate internal details, and follow the agency's official security guidance rather than third-party "check if you are exposed" sites, which are themselves a common scam vector.

For everyone else, the broader lesson echoes our coverage of the surveillance and data-broker ecosystem: a single compromised identity layer can expose an entire organisation at once. Centralised single sign-on is convenient and, when its trust is abused, a single point of catastrophic failure.

Frequently asked questions

What is the DHS 'Icepick' data leak?

It is a dataset, dubbed "Icepick", published by the transparency collective DDoSecrets on 28 October 2026, covering more than 41,000 US Department of Homeland Security personnel. It was obtained by a hacktivist group called the Department of Peace and spans staff at CBP, ICE, HSI and CISA.

How many DHS employees were exposed?

The dataset is reported to hold about 41,191 records, so coverage ranges from "more than 40,000" to "more than 41,000" employees and contractors. Estimates of what share of DHS that represents range from about a seventh to a sixth, depending on the workforce figure used. Treat the number as approximate.

Who leaked the DHS employee data?

A hacktivist group calling itself the Department of Peace obtained the data and passed it to DDoSecrets, which published it on 28 October 2026. DDoSecrets is the publisher and host of the trove, not the group that carried out the intrusion; the motive is reported as political, with no ransom.

What information was in the DHS leak?

The records reportedly include names, work emails, phone numbers, job titles, reporting manager, office locations and assignment details, plus internal organisational structure. Whether home addresses were included is disputed: the publisher says the set holds work contact details but no home addresses, while some outlets referred loosely to "addresses."

Was Okta breached in the DHS leak?

Not established. The hacktivists claim the data came from a compromised single-sign-on service and named Okta, but Okta says it has no evidence its own systems or data were compromised, and Reuters could not corroborate the route. A compromise running through an SSO environment is not the same as the vendor being breached.

How can I check if I am in the Icepick leak?

An unofficial search tool built by the hacktivists circulated alongside the leak and has shifted between domains as hosts took it down. We are not linking it: using it feeds a doxxing tool, and lookalike or phishing copies are already circulating. Anyone who may be affected should rely on official DHS guidance rather than third-party "check if you are exposed" sites.

Is this the same as the Pentagon data breach?

No. This is a hacktivist leak of DHS employee directory records published as "Icepick" by DDoSecrets, with no Social Security numbers reported. The earlier Pentagon DMDC breach centred on Social Security numbers of millions of military-affiliated people. Different data, victims and actors.