‘Icepick’ Leak Exposes Records on 41,000 DHS Employees as Hacktivists Cite Protest, Not Ransom

A hacktivist group calling itself the Department of Peace has put a blunt question in front of the Department of Homeland Security: how much of a workforce directory is too much to lose? On Wednesday, October 28, 2026, the transparency nonprofit Distributed Denial of Secrets published an archive it calls Icepick, covering more than 41,000 DHS employees and contractors. There is no public ransom demand. The note with the files is political: “They have our information, so it’s only fair that we have theirs.”

That line, and the speed with which newsrooms checked the records, turned a claimed identity-system theft into one of the most closely watched U.S. government data incidents of the year. DHS says it is treating the publication as a potential breach. Okta, the identity company named by the hacktivists, says its own systems were not compromised. The distance between those two statements is now the center of the story.

What landed in public, and who put it there

DDoSecrets says it received the material from the Department of Peace, which also shared a copy with Swiss hacker and journalist maia arson crimew. Crimew built a searchable front end that cleaned and enriched the raw records, with help from journalist Ryan Fae, and described the set as a look at who does what work across DHS components, including Immigration and Customs Enforcement. DDoSecrets co-founder Emma Best framed Icepick more narrowly than a full phone book, saying it identifies many of the “architects and drivers” of DHS policy and operations, including officials tied to covert and undercover work, leak investigations, and deportation programs.

By Thursday morning, October 29, CyberScoop reported that the website hosting a searchable form of the data had been taken offline. Copies already in journalists’ hands had not vanished with it. TechCrunch matched names of known Homeland Security employees against an offline copy and tied record timestamps to roughly mid-August. Help Net Security reported that Reuters matched details on six employees to other records and reached three by phone; one said the call was the first they had heard of a breach. WIRED reported that the records it reviewed were last updated on August 19, 2026. The Department of Peace has not publicly explained the technique. TechCrunch said the hacker did not answer questions about how the theft was carried out.

The name is not new to the department. Nextgov/FCW noted that the group previously claimed a DHS intrusion involving contractor records in March, and TechCrunch described the October release as the group’s second Homeland Security-related claim this year.

Names, phones, offices, and a map of who can open which tools

Outlets that reviewed the files say this is not a payroll dump of Social Security numbers. It reads more like an identity directory with operational labels attached. Reported fields include names, job titles, work email addresses, cell phone numbers, and office locations, plus group memberships that show which systems and applications an account may access.

Counts differ slightly because the set is large and incomplete. TechCrunch put about 21,000 records with U.S. Customs and Border Protection, about 10,000 with ICE and Homeland Security Investigations combined, and just under 1,000 with the Cybersecurity and Infrastructure Security Agency, plus headquarters and other components such as U.S. Citizenship and Immigration Services and the Federal Protective Service. A Cybernews tally of the published index put the total at 41,191 people, with the same heavy tilt toward CBP, ICE, HSI, and USCIS, and smaller slices for CISA and other DHS units. Relative to a workforce TechCrunch put near 220,000, that is roughly a fifth of the department. WIRED described about a seventh, spanning DHS and seven component agencies. Either figure is a workforce-scale exposure, not a stray spreadsheet.

The access-group layer is the sharper risk. WIRED reported permission groups referencing Palantir’s Falcon investigative platform and PenLink, which analyzes phone records and social media. UPI reported that operation names and technology providers appear in the material, including Cellebrite and Palantir. TechCrunch described groups tied to ordinary tools such as Microsoft 365 and to more sensitive capabilities, including a facial-recognition app and groups associated with investigations into China-linked hacking activity. Some labels point at undercover and intercept work. A group name in a login system can be sensitive even when the file does not include the contents of an investigation.

Illumio public sector CTO Gary Barlet told SecurityWeek that if an attacker knows which employees can reach which systems, they have effectively been handed a roadmap for who to target next. That is an impact, not a method. It is also why a directory leak and a password dump are different incidents, even when no passwords have surfaced in the public reporting.

The Okta claim, and what DHS and Okta actually said

The Department of Peace told outlets it pulled the database from an Okta single sign-on service that DHS employees and contractors use to reach a central environment. Single sign-on is meant to be a control: one login, many applications, fewer passwords scattered across the enterprise. The directory behind that login is also a concentrated target, because it holds names, contact data, and application rights together.

Okta’s line has been consistent. A spokesperson told SecurityWeek and WIRED: “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised.” Those statements do not, by themselves, rule out a problem inside a customer tenant. Reuters said it could not immediately corroborate the claimed Okta path, and reporting has treated the route as an attributed claim rather than a confirmed root cause.

DHS later issued a short statement, carried by SecurityWeek, TechCrunch, and WIRED in nearly the same words: “DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.” As of October 29, the department had not publicly confirmed the intrusion path, the exact headcount, or whether the issue used to collect the data has been closed.

A protest note, not a ransom note

Nothing in the first wave of coverage describes a payment demand or a leak-site countdown. The Department of Peace has instead tied the release to immigration enforcement. A spokesperson told CyberScoop: “On July 17th, Markwayne Mullin said he was ‘turning up the heat.’ This is what happens to ICE when you do that.” Mullin is the current DHS secretary. In a note with the files, the group said it hoped the data could be used to limit further harm by the department.

People who published the archive have made a transparency argument. Best said the material could support journalism, congressional oversight, and public-records requests. Crimew told WIRED she did not think the public should be scared out of looking into the department. Those are claims about accountability. They do not remove the risk to employees whose work phones and office assignments are easier to find, including people who are not public figures and staff whose group labels indicate undercover assignments.

The release also lands in a rough season for federal personnel data. In September, the extortion group ShinyHunters claimed a large theft of FBI employee information — a ransom-style incident with a very different motive, aimed at the same kind of target: the people who work inside the government.

What security teams and exposed staff should do now

Until DHS publishes a fuller accounting, the public facts describe an open incident. The useful response is defensive, and it does not depend on knowing a technique the hacktivists have not explained.

• Verify the channel, not the caller. Work cell numbers and emails in a leak are enough for convincing vishing and spearphishing. Unexpected messages that cite an internal app, an office, or “your record in the dump” should be confirmed through a known internal path, not by trusting the number in the message.
• Scope the identity tenant, not only the vendor statement. Okta’s denial covers Okta’s cloud. Customer tenants, admin tokens, and integration accounts are a separate question. Identity teams should review privileged roles and bulk directory-export activity around mid-August 2026, the window newsrooms tied to the timestamps, and preserve logs before they age out.
• Treat app-access labels as future pretext. Entitlement maps do not hand over passwords, but they tell a social engineer which product name will sound real. The countermeasure is least privilege, tighter control over who can read or export the directory, and phishing-resistant multifactor authentication on the single sign-on, especially for directory administrators.
• Warn sensitive roles directly. Staff in undercover, intercept, or specialized investigative groups need a specific notice, not only a generic banner. Where policy still allows it, those assignments should not sit in broadly readable groups next to routine desktop software.
• Expect copycat lookup sites. CyberScoop reported the original searchable front end offline by Thursday morning. Pages that offer to show someone their own leaked record are a common follow-on. Official guidance should come from DHS or an employer, not from an unsolicited link.

Vendors whose names appear in group labels, including Palantir, PenLink, and Cellebrite, will be asked whether a tenant was touched or only a label inside DHS’s identity store. Coverage available on October 29 does not accuse those companies of being the breach point. The answer depends on an investigation that is still early.

Icepick is a reminder that single sign-on concentrates risk as well as convenience. A system built to cut password sprawl can become one shelf of names, phones, offices, and application rights. DHS says it is working the incident. Okta says its platform was not compromised. The hacktivists say they were answering a political threat, not sending an invoice. For the more than 41,000 people in the files, the distinction that matters this week is simpler: work identities are public, the intrusion path is not yet established in official statements, and the next contact is more likely to be a phone call than another manifesto.