BreachPublished 29 Oct 2026

Over 41,000 DHS Employee Records Leaked Online

Source SecurityWeek

Description

A hacker leaked over 41,000 records of US Department of Homeland Security employees, allegedly stolen from an Okta single sign-on system. The leaked data includes personal and work information such as names, work emails, phone numbers, job titles, office locations, and access details to internal systems and applications. The breach affects employees from multiple DHS agencies, including Customs and Border Protection, Immigration and Customs Enforcement, Homeland Security Investigations, and CISA. The leak provides attackers with detailed access information, potentially enabling targeted attacks on critical personnel and systems.

Impact

The leaked data exposes personal and professional details of thousands of DHS employees, including sensitive access information to internal systems. This exposure could enable attackers to conduct targeted social engineering, spear-phishing, or direct attacks on critical DHS infrastructure and personnel. The identification of officials in covert and sensitive roles increases the risk of operational compromise. The breach undermines the confidentiality and potentially the integrity of DHS internal systems and may impact national security operations.

Defensive guidance

Okta has stated that its systems remain secure and there is no evidence of compromise on their side. DHS and affected agencies should conduct thorough internal investigations to confirm the source and scope of the breach. Organizations should review and potentially revoke or rotate access credentials associated with the leaked accounts. Enhanced monitoring for suspicious activity targeting DHS systems and personnel is recommended.

Summary

A threat actor known as Department of Peace leaked a database named 'Icepick' containing over 41,000 records of DHS employees. The data was reportedly stolen from an Okta single sign-on system used by DHS employees and contractors. The compromised information includes personal identifiers and detailed access permissions to internal DHS systems, which could facilitate further targeted intrusions. Okta has denied any compromise of its systems. The leak includes sensitive roles such as officials involved in covert operations and deportation programs. This breach follows recent high-profile attacks on US government agencies and highlights risks associated with access management systems.

References

securityweek.com/over-41000-dhs-employee-records-leaked-online/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 Oct 2026, 13:17 UTC

Technical details

References

Community reviews