Skip to content
NewA calmer, faster ZeroHour
StoryData breachcritical

DHS Leaks Over 41,000 Employee Records via Okta

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Over 41,000 DHS employee records leaked via Okta SSO; searchable Icepick archive online despite Bluesky blocks and takedown notices.

A hacktivist group calling itself the Department of Peace leaked more than 41,000 DHS employee and contractor records from the agency's Okta single sign-on system. The archive, published by Distributed Denial of Secrets as Icepick, covers CBP (over half), ICE, USCIS, and CISA staff, including work emails, phones, titles, office locations, and access to tools like Palantir, PenLink, and Mobile Fortify. Records also list groups tied to undercover operations. Okta states it has no evidence of compromise, while DHS says it is aware of a potential breach and is addressing it. The searchable site faced hosting challenges and Bluesky blocked related links.

Key facts
  • Over 41,000 records leaked from DHS Okta system
  • Covers CBP, ICE, USCIS, CISA; includes undercover groups
  • Published as Icepick by DDoSecrets on October 29, 2026
  • DHS aware of potential breach, Okta no evidence of compromise
  • Search tool faced takedown notices and reappeared online
  • Includes access to Microsoft 365, ChatGPT, PenLink
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Aug 19, 2026Database last updated and copied from Okta · Ars Technica
  2. Oct 29, 2026DDoSecrets publishes Icepick archive of 41,000+ records · SecurityWeek
  3. Oct 29, 2026Bluesky blocks links to leaked data · TechCrunch
  4. Oct 29, 2026ZeroFox requests takedown; site placed on serverHold · CyberScoop
  5. Oct 30, 2026Site reappears under new registrar · CyberScoop

What each outlet adds

beyond the shared facts
  • Ars TechnicaDetails on undercover and surveillance program groups
  • TechCrunchVerification of one phone number and Bluesky blocking
  • DataBreaches.netCorroboration with Nextgov/FCW and AT&T provider check
  • CyberScoopDetails on hosting challenges and reappearance
  • Malwarebytes LabsComparison to other DHS thefts and additional CBP users
Vendors
OktaPalantirMicrosoft
Products
FalconPenLinkActive DirectoryMobile FortifyBluesky
Threat actors
Department of Peace
Victims
Department of Homeland SecurityImmigration and Customs EnforcementUS Customs and Border ProtectionUS Department of Homeland SecurityCustoms and Border ProtectionCybersecurity and Infrastructure Security AgencyU.S. Department of Homeland SecurityU.S. Customs and Border ProtectionCISA
Organizations
Distributed Denial of SecretsCybersecurity and Infrastructure Security AgencyUS Citizenship and Immigration ServicesImmigration and Customs EnforcementCustoms and Border ProtectionDDoSecretsZeroFoxFlokiNETCentralNicBluesky
Countries
United States

Coverage

oldest first · one row per article · UTC
  1. · 13d ago SecurityWeekFirst report

    Department of Peace leaks records on over 41,000 DHS employees

    The posted set includes work contacts, job details, and which internal systems each account can reach; Okta denies a compromise.

  2. · 13d ago Ars Technica · Security

    Leak exposes records on more than 41,000 DHS workers

    The archive includes emails, phones, office addresses, and groups tied to undercover and surveillance programs.