Hackers publish work details on more than 41,000 DHS employees
The Icepick dump lists ICE, CBP and CISA contacts and internal groups; DHS calls it a potential breach.
76
Victim
Immigration and Customs Enforcement
- Mentions · 7d6
- Mentions · 30d6
- All mentions6
- First seenOct 28, 2026
- Last mentioned10h ago
Timeline
6 articles · newest firstHacker leaks work contacts for more than 40,000 DHS employees
Records cover CBP, ICE, and CISA staff; the leaker claims an Okta SSO source, which Okta says it has no evidence was compromised.
76
Leak exposes records on more than 41,000 DHS workers
The archive includes emails, phones, office addresses, and groups tied to undercover and surveillance programs.
86
Leak exposes personal details of over 41,000 DHS employees
Distributed Denial of Secrets published records it attributes to “Department of Peace”; Reuters matched some entries but not the collection method.
78
Hacker publishes work data on more than 40,000 Homeland Security employees
The dataset covers CBP, ICE, and CISA contacts plus application-access groups; Okta denies its systems were breached.
78
Leak details more than 41,000 Homeland Security workers and access groups
DDoSecrets published the archive as Icepick; group names reference undercover work, wiretaps, and surveillance tools.
78
Appears with
- Oktavendor · 6
- Department of Peacethreat actor · 5
- U.S. Department of Homeland Securityvictim · 4
- DDoSecretsorganization · 4
- U.S. Customs and Border Protectionvictim · 3
- CISAvictim · 3
- Cybersecurity and Infrastructure Security Agencyvictim · 2
- Distributed Denial of Secretsorganization · 2
- Customs and Border Protectionvictim · 2
- US Customs and Border Protectionvictim · 1
- Homeland Security Investigationsvictim · 1
- Active Directoryproduct · 1
- US Citizenship and Immigration Servicesorganization · 1
- Falconproduct · 1
- Palantirvendor · 1
- US Department of Homeland Securityvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.