# DHS Data Leak Exposes 40,000 Staff and Contractors in Icepick Dump

- URL: https://usa-24.com/dhs-data-breach-40000-employees/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-29T18:25:10.769Z
- Updated: 2026-10-29T18:25:10.777Z
- Topics: Data Breach, DHS, Okta, DDoSecrets, Identity Security, Hacktivism

> Hackers calling themselves the Department of Peace released a searchable Icepick dataset of more than 40,000 DHS staff and contractors. DHS is investigating, and Okta denies being the entry point.

## Key takeaways

- DHS says it is aware of a potential breach, while Okta says it has no evidence its systems were compromised.
- The Icepick dataset, published October 28, 2026 by DDoSecrets, lists more than 40,000 current and former DHS employees and contractors.
- Reporting so far covers names, phone numbers, email addresses, job titles, office locations and assignment descriptions, with no reported passwords or Social Security numbers.
- Reuters matched personal data for six named employees to credit bureau and breach records but could not verify the full trove.
- DHS staff should verify unexpected contact through official channels and ask their security office whether their credentials were reset.

The DHS data breach surfaced on Wednesday, October 28, 2026, when a hacktivist group calling itself the "Department of Peace" put a searchable list of more than 40,000 current and former Homeland Security employees and contractors into circulation. Distributed Denial of Secrets (DDoSecrets), a transparency nonprofit that has published leaked datasets for years, released the trove as a database it calls Icepick. The Department of Homeland Security (DHS) says it is aware of a potential breach, but the entry point the hackers claim is disputed.

The records reach into agencies that handle some of the government's most sensitive work. Coverage lists personnel at U.S. Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), Homeland Security Investigations (HSI) and the Cybersecurity and Infrastructure Security Agency (CISA). That mix makes this a federal security story, not only a privacy one. The leak is still developing, and several basic facts remain unsettled.

## What the DHS data breach exposed

Reports disagree on the headcount. Some outlets count more than 40,000 records, while [SecurityWeek](https://www.securityweek.com/over-41000-dhs-employee-records-leaked-online/) puts the total above 41,000. Coverage ties the gap to counting method, and the dataset also includes contractors and possible duplicate entries.

According to [NPR](https://www.npr.org/2026/10/28/nx-s1-6021497/dhs-hack-ice), the database covers about a fifth of DHS's workforce, which has a little more than 220,000 people. That is a large enough share that the leak touches many offices, not a handful of officials.

Reported fields are mostly contact and job data:

- Names, phone numbers and email addresses
- Job titles and office locations
- Internal group memberships
- Descriptions of assignments

[Tech Insider](https://tech-insider.org/icepick-dhs-employee-data-leak-40000-ddosecrets-2026/), citing a BBC report, puts CBP records above 21,000 and ICE records near 6,600. Those agency splits come through a secondary outlet, not a DHS disclosure, so treat them as provisional.

Reuters could not verify the full trove. It did match personal information about six named DHS employees to credit bureau and breach records, and it confirmed details by calling three employees. One of them said they had not heard of any breach, according to [a Reuters story carried by the Korea Times](https://www.koreatimes.co.kr/world/20261029/leak-website-releases-data-on-thousands-of-us-homeland-security-employees).

Reporting so far has not found passwords or Social Security numbers in the data. That absence matters, because the difference between a contact list and an identity-theft file often comes down to those fields.

## Who published the data and why it matters

The Department of Peace shared copies with DDoSecrets, with journalist Ryan Ottignon and with activist "maia arson crimew," according to coverage. The group says it got the records by subverting DHS's single sign-on system, which runs through Okta. None of that has been independently verified.

Emma Best, co-founder of DDoSecrets, described the leak's construction as "extraordinary but deceptive in its simplicity." She said the material could support journalism, public records requests and congressional oversight. Those uses cut both ways. The same searchable records that let a reporter check staffing levels could also help a stalker locate a target.

The group's release statement ties its action to comments by DHS Secretary Markwayne Mullin on July 17 about intensifying immigration enforcement, as [IBTimes UK reported](https://www.ibtimes.co.uk/dhs-employee-data-reported-breach-online-1828818). Coverage describes the release as a response to immigration enforcement. Who the Department of Peace is, and whether it holds more material, has not been established.

## Why the Okta claim is disputed

Okta has rejected the claim. "Okta is secure, and we have no evidence our data or systems were compromised," a company spokesperson told Reuters and SecurityWeek. DHS has not named an entry point. Its statement, reported by Nextgov, said the department is "aware of a potential breach and is actively working to address the situation swiftly and effectively." No named DHS spokesperson appears in the sources reviewed, and the department said it would provide more information when it is available.

Single sign-on explains why the claim matters even if Okta is not the door. One login reaches many internal applications, so a compromise of that layer can expose directory data across an agency. The intrusion date has not been established in the coverage reviewed. The claimed route could just as easily run through a DHS-side account, a DHS system or a third-party vendor, and none of those possibilities has been ruled in or out.

Okta has been through this before. In March 2022, the company said its service had not been breached. A later investigation found that an attacker had five days of access to a support engineer's laptop at a third-party contractor, according to [Pasquale Pillitteri's summary of the case](https://pasqualepillitteri.it/en/news/27968/dhs-data-breach-40000-employees-okta-denies). The lesson is not that the current denial is wrong. Early denials and final findings can diverge by months, and organizations should plan for that gap.

Identity theft is a recurring theme for USA 24. We have reported on a [Microsoft Authenticator flaw that let Android apps steal work login tokens](https://usa-24.com/microsoft-authenticator-vulnerability-android/), and on a credential-theft campaign that [stole 70,000 credentials from VPN and firewall devices](https://usa-24.com/k0t-fortigate-credentials-theft/). Security teams at other agencies and enterprises that use Okta or similar identity services should review single sign-on logs for unusual logins and check administrator access now, rather than waiting for a confirmed route.

## Which DHS roles face the greatest risk

Coverage reports that the records include undercover and surveillance-related roles. That detail is what makes this leak different from a standard staff directory. A name and phone number tell an attacker who works at an agency. An assignment description tells them what that person does, which is the information needed to write a convincing lure or to find someone who is not supposed to be found.

Federal employees and contractors named in the dataset face doxxing, harassment and targeted phishing. Contractors are included too, so the exposure reaches beyond the federal payroll. Because the group tied its release to immigration enforcement, staff in deportation-related roles should assume they may be a specific target, and their security offices should treat any new contact with extra caution.

## What DHS staff and contractors should do now

Typical consumers are not the direct target here, but phishing built on leaked contact data tends to spread beyond the original list. No official advisory with specific instructions had been published as of this writing, so the steps below reflect standard practice for exposed staff directories.

1. Treat unexpected calls, texts or emails that mention your job, office or assignment as suspicious, even if the sender knows your name.
2. Verify any request using a phone number from your agency directory or security office, never one supplied in the message.
3. Report suspicious contact through your agency's official security or incident channel.
4. Ask your security office whether your account credentials were reset and whether your single sign-on sessions were reviewed.
5. Ask whether your agency can require phishing-resistant multi-factor authentication for staff accounts.
6. Avoid searching for or downloading copies of the dataset from unofficial mirrors. Those files can carry malware, and finding your own name there confirms nothing.

If you want to know whether your information is in the file, ask your agency rather than searching a leaked copy.

## What comes next for the DHS data breach

Several questions will determine how serious this becomes. Will DHS confirm a breach, and will it publish findings with a timeline? Does the Okta route hold up, or does it point to a DHS account, system or vendor? Does the dataset contain Social Security numbers, passwords or case files that have not appeared in reporting? Reuters' partial verification is a useful start, but it is not an audit.

Watch for whether the Department of Peace releases more material, whether lawmakers request briefings, and whether any agency or law enforcement body pursues the people behind the release. None of those outcomes is confirmed. The answers will decide whether this is remembered as a contact-list leak or as the case that forced the government to rethink how it protects the people behind its most sensitive work.

## Frequently asked questions

### Is the DHS data breach confirmed?

DHS says it is aware of a potential breach and is working to address it, but it has not confirmed the scope. Okta says it has no evidence its own systems were compromised. Reuters verified personal details for six named employees but could not verify the full trove.

### How many people are in the Icepick leak?

Reports range from more than 40,000 to more than 41,000 records, and the difference comes down to counting method. According to NPR, the database covers about a fifth of DHS's workforce of a little more than 220,000 people. The dataset also includes contractors and possibly duplicate entries.

### Were passwords or Social Security numbers leaked in the DHS data breach?

No outlet reviewed reported passwords or Social Security numbers in the dataset. Reporting so far lists names, phone numbers, email addresses, job titles, office locations, group memberships and assignment descriptions. Whether more sensitive data exists has not been established.

### What should DHS employees do if they receive suspicious contact?

Treat unexpected messages that mention your job or assignment as suspicious, even if they use your name. Verify the request through your agency directory, report it through official security channels, and ask your security office whether your credentials were reset.

## Sources

1. [DHS personnel leak exposes contact details and sensitive job information — Nextgov/FCW](https://www.nextgov.com/cybersecurity/2026/10/dhs-personnel-leak-exposes-contact-details-and-sensitive-job-information/416901/)
2. [Hackers expose the identities of more than 40,000 DHS employees — NPR](https://www.npr.org/2026/10/28/nx-s1-6021497/dhs-hack-ice)
3. [Over 41,000 DHS Employee Records Leaked Online — SecurityWeek](https://www.securityweek.com/over-41000-dhs-employee-records-leaked-online/)
4. [Leak website releases data on thousands of US Homeland Security employees — Korea Times (Reuters)](https://www.koreatimes.co.kr/world/20261029/leak-website-releases-data-on-thousands-of-us-homeland-security-employees)
5. [DHS Employee Data Leak: 40,000+ Exposed in Icepick [2026] — Tech Insider](https://tech-insider.org/icepick-dhs-employee-data-leak-40000-ddosecrets-2026/)
6. [Over 40K US Homeland Security Employees' Data Reportedly Released Online, Leak Site Says — IBTimes UK](https://www.ibtimes.co.uk/dhs-employee-data-reported-breach-online-1828818)
7. [Hackers steal data on 40,000 DHS employees as Okta denies breach — Pasquale Pillitteri](https://pasqualepillitteri.it/en/news/27968/dhs-data-breach-40000-employees-okta-denies)