The DHS data breach surfaced on Wednesday, October 28, 2026, when a hacktivist group calling itself the "Department of Peace" put a searchable list of more than 40,000 current and former Homeland Security employees and contractors into circulation. Distributed Denial of Secrets (DDoSecrets), a transparency nonprofit that has published leaked datasets for years, released the trove as a database it calls Icepick. The Department of Homeland Security (DHS) says it is aware of a potential breach, but the entry point the hackers claim is disputed.
The records reach into agencies that handle some of the government's most sensitive work. Coverage lists personnel at U.S. Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), Homeland Security Investigations (HSI) and the Cybersecurity and Infrastructure Security Agency (CISA). That mix makes this a federal security story, not only a privacy one. The leak is still developing, and several basic facts remain unsettled.
What the DHS data breach exposed
Reports disagree on the headcount. Some outlets count more than 40,000 records, while SecurityWeek puts the total above 41,000. Coverage ties the gap to counting method, and the dataset also includes contractors and possible duplicate entries.
According to NPR, the database covers about a fifth of DHS's workforce, which has a little more than 220,000 people. That is a large enough share that the leak touches many offices, not a handful of officials.
Reported fields are mostly contact and job data:
- Names, phone numbers and email addresses
- Job titles and office locations
- Internal group memberships
- Descriptions of assignments
Tech Insider, citing a BBC report, puts CBP records above 21,000 and ICE records near 6,600. Those agency splits come through a secondary outlet, not a DHS disclosure, so treat them as provisional.
Reuters could not verify the full trove. It did match personal information about six named DHS employees to credit bureau and breach records, and it confirmed details by calling three employees. One of them said they had not heard of any breach, according to a Reuters story carried by the Korea Times.
Reporting so far has not found passwords or Social Security numbers in the data. That absence matters, because the difference between a contact list and an identity-theft file often comes down to those fields.
Who published the data and why it matters
The Department of Peace shared copies with DDoSecrets, with journalist Ryan Ottignon and with activist "maia arson crimew," according to coverage. The group says it got the records by subverting DHS's single sign-on system, which runs through Okta. None of that has been independently verified.
Emma Best, co-founder of DDoSecrets, described the leak's construction as "extraordinary but deceptive in its simplicity." She said the material could support journalism, public records requests and congressional oversight. Those uses cut both ways. The same searchable records that let a reporter check staffing levels could also help a stalker locate a target.
The group's release statement ties its action to comments by DHS Secretary Markwayne Mullin on July 17 about intensifying immigration enforcement, as IBTimes UK reported. Coverage describes the release as a response to immigration enforcement. Who the Department of Peace is, and whether it holds more material, has not been established.
Why the Okta claim is disputed
Okta has rejected the claim. "Okta is secure, and we have no evidence our data or systems were compromised," a company spokesperson told Reuters and SecurityWeek. DHS has not named an entry point. Its statement, reported by Nextgov, said the department is "aware of a potential breach and is actively working to address the situation swiftly and effectively." No named DHS spokesperson appears in the sources reviewed, and the department said it would provide more information when it is available.
Single sign-on explains why the claim matters even if Okta is not the door. One login reaches many internal applications, so a compromise of that layer can expose directory data across an agency. The intrusion date has not been established in the coverage reviewed. The claimed route could just as easily run through a DHS-side account, a DHS system or a third-party vendor, and none of those possibilities has been ruled in or out.
Okta has been through this before. In March 2022, the company said its service had not been breached. A later investigation found that an attacker had five days of access to a support engineer's laptop at a third-party contractor, according to Pasquale Pillitteri's summary of the case. The lesson is not that the current denial is wrong. Early denials and final findings can diverge by months, and organizations should plan for that gap.
Identity theft is a recurring theme for USA 24. We have reported on a Microsoft Authenticator flaw that let Android apps steal work login tokens, and on a credential-theft campaign that stole 70,000 credentials from VPN and firewall devices. Security teams at other agencies and enterprises that use Okta or similar identity services should review single sign-on logs for unusual logins and check administrator access now, rather than waiting for a confirmed route.
Which DHS roles face the greatest risk
Coverage reports that the records include undercover and surveillance-related roles. That detail is what makes this leak different from a standard staff directory. A name and phone number tell an attacker who works at an agency. An assignment description tells them what that person does, which is the information needed to write a convincing lure or to find someone who is not supposed to be found.
Federal employees and contractors named in the dataset face doxxing, harassment and targeted phishing. Contractors are included too, so the exposure reaches beyond the federal payroll. Because the group tied its release to immigration enforcement, staff in deportation-related roles should assume they may be a specific target, and their security offices should treat any new contact with extra caution.
What DHS staff and contractors should do now
Typical consumers are not the direct target here, but phishing built on leaked contact data tends to spread beyond the original list. No official advisory with specific instructions had been published as of this writing, so the steps below reflect standard practice for exposed staff directories.
- Treat unexpected calls, texts or emails that mention your job, office or assignment as suspicious, even if the sender knows your name.
- Verify any request using a phone number from your agency directory or security office, never one supplied in the message.
- Report suspicious contact through your agency's official security or incident channel.
- Ask your security office whether your account credentials were reset and whether your single sign-on sessions were reviewed.
- Ask whether your agency can require phishing-resistant multi-factor authentication for staff accounts.
- Avoid searching for or downloading copies of the dataset from unofficial mirrors. Those files can carry malware, and finding your own name there confirms nothing.
If you want to know whether your information is in the file, ask your agency rather than searching a leaked copy.
What comes next for the DHS data breach
Several questions will determine how serious this becomes. Will DHS confirm a breach, and will it publish findings with a timeline? Does the Okta route hold up, or does it point to a DHS account, system or vendor? Does the dataset contain Social Security numbers, passwords or case files that have not appeared in reporting? Reuters' partial verification is a useful start, but it is not an audit.
Watch for whether the Department of Peace releases more material, whether lawmakers request briefings, and whether any agency or law enforcement body pursues the people behind the release. None of those outcomes is confirmed. The answers will decide whether this is remembered as a contact-list leak or as the case that forced the government to rethink how it protects the people behind its most sensitive work.
