The DHS data leak called Icepick went public on 28 October 2026, when the transparency group Distributed Denial of Secrets (DDoSecrets) published it. It is an internal database of more than 41,000 employees of the US Department of Homeland Security (DHS). A hacktivist group calling itself Department of Peace says it took the records from a single sign-on service used at DHS and handed them to DDoSecrets. The records are a staff directory, not a customer or citizen database.
This article explains what the release contains, why a directory matters to attackers, which claims are still disputed, and what other organizations can take from it. We do not link to the data files or to any search tool built on it, and we do not name any person in it.
What Does the Icepick Release Contain?
According to DDoSecrets’ own description, the main download is about 167 MB and holds names, offices, contact details and assignments. Malwarebytes lists work email addresses, phone numbers, office addresses, job titles and membership of internal DHS groups, across nearly 7,000 offices.
- Published.
- 28 October 2026 by DDoSecrets.
- Size.
- More than 41,000 employees (Reuters: more than 40,000).
- Fields.
- Names, work email, phone, office address, job title, internal group membership (Malwarebytes).
- Claimed source.
- An Okta single sign-on service used at DHS, per Department of Peace.
- Timing.
- Record timestamps point to around mid-August, per TechCrunch as reported by Malwarebytes.
- Not in the release.
- Social Security numbers, medical records and home addresses are not listed as fields by Malwarebytes.
The agency split depends on who counts. Malwarebytes reports more than 21,000 Customs and Border Protection (CBP) staff and almost 6,600 Immigration and Customs Enforcement (ICE) staff. Bitdefender cites roughly 10,000 ICE and almost 1,000 Cybersecurity and Infrastructure Security Agency (CISA) records. We treat the totals as reported claims, not audited counts.
Why Does a Staff Directory Matter to Attackers?
A directory is a map of an organization. Names, titles and email addresses tell an attacker who to write to. Group memberships go further: Reuters reported that titles and email groups showed which agents were assigned to special operations, surveillance, computer forensics and undercover work.
That detail turns generic phishing into targeted phishing, because a message can name a real colleague, team or tool. Malwarebytes also reports that group data shows which staff have access to specific investigative tools, including a facial recognition app. Malwarebytes notes that DHS has warned about harassment, stalking and physical harm, so doxing is the larger concern for the people listed.
This is also why the release is more than a name list. Our own view is that the combination of contact details and role data is what defenders should model, because it lowers the cost of every later social engineering attempt.
How the Claims and Responses Line Up
| Point | Position | Source |
|---|---|---|
| How the data was taken | Department of Peace says it came from an Okta single sign-on service used at DHS | DDoSecrets and Reuters; Reuters could not immediately corroborate it |
| Okta | Okta said “Okta is secure, and we have no evidence our data or systems were compromised” | Okta statement, as quoted by Reuters |
| DHS | DHS told reporters it was “aware of a potential breach” | Malwarebytes; Reuters’ first report said DHS had not immediately responded |
| Authenticity | Reuters matched details of six DHS employees to credit bureau and breach records and phoned three, confirming details, but could not verify the whole set | Reuters |
| Motive | The group said DHS employees “have our information, so it’s only fair that we have theirs” | Reuters |
Was Okta Breached?
Not according to Okta, and the question is open. Reuters said it could not immediately corroborate the single sign-on claim. Malwarebytes points out that stolen credentials for a DHS account could also explain the access, which would not require a flaw in Okta at all.
Until DHS or Okta publishes findings, the access path stays a claim by a hacktivist group. The group also said in March that it had stolen DHS contract documents, according to Malwarebytes, so this is not its first claim against the department. For how these groups work, see our glossary entry on hacktivism.
What Happened After Publication?
DDoSecrets says the original searchable site was taken offline by its registrar, and that the search tool moved to a new address. The same note says the source code of the tool is available for download. Brandefense Blackhole holds 22 Telegram posts about the release from 28 to 30 October 2026, almost all reshares of news articles.
Leak sites like this one are a recurring way for stolen data to reach the public. Our glossary entry on the data leak site explains the model.
What Can Other Organizations Take From This?
Few organizations are DHS, but nearly all keep a directory in an identity provider. The steps below are our advice, not findings from the sources above.
- Treat the directory as sensitiveNames, titles and group memberships together are a targeting map. Limit who can export the full user list and log every export.
- Protect identity admin accountsRequire phishing-resistant sign-in for single sign-on administrators and review active API tokens.
- Review group namesGroup names can reveal projects, tools and clearances. Keep descriptive names out of attributes that sync to wide audiences.
- Brief staff on targeted phishingWarn people that a message naming a real colleague or tool can still be fake, and give them one place to report it.
- Watch for your own dataMonitor leak sites and cybercrime channels for your staff directory; see our page on data leak detection.
Identity providers have been in the middle of earlier incidents too. Our report on the Okta breach and its victims shows how one of them unfolded. The DHS case differs because the access path is still only a claim.
What Is Still Unclear?
DHS has given reporters only a short statement that it was aware of a potential breach (Malwarebytes), and the access path is unconfirmed. Counts differ between outlets, so the number of current staff in the data is not known. We will not add details about individuals, and we recommend that readers do not seek out the files.