Icepick leak of 41,000+ DHS personnel records, allegedly from Okta SSO: DHS confirms potential breach, takedowns and Bluesky block

Linha do tempo

1. bitdefender.com ↗ · pub. 30/10/2026 07:33 · coletado 30/10 10:00

   Hacktivist group "Department of Peace" leaks personnel data of 41,000+ DHS staff, including ICE, CBP and CISA employees

   ler a análise desta fonte ocultar

   A hacktivist group calling itself "Department of Peace" has published online the personnel records of more than 41,000 US Department of Homeland Security employees, under the title "Icepick". The leak includes names, job titles, work email addresses, phone numbers and office locations; over half relate to CBP staff, around 10,000 to ICE employees and nearly 1,000 to CISA. According to WIRED, the dataset also covers undercover personnel and staff involved in wiretapping and communications interception. The group claims the data was taken from an Okta single sign-on system used to access the DHS central network; Okta states it has seen no evidence of compromise of its own systems. The same group previously claimed to have breached DHS contract data covering more than 6,000 firms including L3Harris, Raytheon, Palantir, Microsoft and Oracle.

   Technical Details

   The dataset is distributed via torrent and through a searchable web interface, lowering the barrier for exploitation. Records reportedly reveal which tools and services individual employees can access, including Palantir Falcon, PenLink and Mobile Fortify, a facial recognition app used by immigration agents. Threat intelligence commentary cited by WIRED describes the data, if authentic, as an "extraordinarily valuable intelligence resource" for adversaries seeking to penetrate DHS, identify vulnerable personnel or compromise ongoing investigations.

   Remediation

   Exposed personnel should treat unexpected emails, texts and calls with caution, particularly messages claiming to be from IT support or requesting approval of a login (MFA fatigue / SSO phishing). Organizations should monitor for targeted phishing and account takeover attempts against the exposed identities and consider credential and MFA resets for affected accounts.

2. securityaffairs.com ↗ · pub. 30/10/2026 03:26 · coletado 30/10 04:00

   Hacker 'Department of Peace' leaks data on 40,000+ DHS employees, including CBP, ICE and CISA staff

   ler a análise desta fonte ocultar

   A hacker using the alias Department of Peace has leaked personal and organizational data on more than 40,000 U.S. Department of Homeland Security (DHS) employees, exposing names, job titles, work email addresses, cell phone numbers and office locations. The actor claims the data was taken from DHS's Okta single sign-on system, which manages access for employees and contractors across DHS agencies; Okta says it has found no evidence that its own systems or data were compromised. Roughly 21,000 records belong to CBP, about 10,000 to ICE and Homeland Security Investigations, and just under 1,000 to CISA, with the remainder from DHS headquarters, USCIS and the Federal Protective Service. The dataset, dubbed Icepick, was shared by journalist maia arson crimew with DDoSecrets; TechCrunch verified records suggesting the database was copied around mid-August 2026. DHS says it is aware of a potential breach and is investigating; the actor framed the leak as a response to government actions involving ICE.

   Technical Details

   The leaked database reportedly includes IT and login records showing which internal systems and applications each account can access, effectively mapping DHS's organizational structure and reporting lines. Access entitlements referenced include Microsoft 365, ChatGPT, Penlink surveillance software and Mobile Fortify, a facial recognition app used by CBP and ICE; over 2,000 HSI employees appear in Penlink-related groups. The initial access method has not been disclosed by the hacker or DHS. This is the second DHS-linked incident attributed to the same actor this year, following a claimed theft of thousands of government contracts.

   Remediation

   Affected personnel face elevated phishing, vishing, SIM-swap and physical targeting risk given the exposure of cell numbers and office locations. Organizations relying on SSO platforms should audit entitlement exports, restrict directory and group-membership visibility, enforce phishing-resistant MFA for admin accounts, and monitor for anomalous bulk directory queries or API token abuse.

3. cyberscoop.com ↗ · pub. 29/10/2026 17:58 · coletado 29/10 19:00

   DHS contractor ZeroFox moves to take down 'Icepick' archive exposing 41,000+ DHS employee records

   ler a análise desta fonte ocultar

   Hacktivists published Icepick, a searchable archive of data allegedly taken from a breached Department of Homeland Security (DHS) database, covering more than 41,000 employees. DHS contractor ZeroFox sent takedown requests to hosting and registrar providers; Icelandic host FlokiNET publicly refused, but registrar CentralNic placed the domain icepi.cx on serverHold, knocking the site offline before it returned Thursday under a different registrar. DHS confirmed it is "aware of a potential breach" and said it is working to protect employees, without further detail. Bluesky was also blocking links to the archive for sharing contact information without consent. FlokiNET argued the data concerns work identities of public officials rather than private individuals, while ZeroFox countered that the data was stolen and allows real people to be located.

   Technical Details

   The article does not describe the intrusion vector or the DHS database involved. The exposed records reportedly include employer, role and work contact details for over 41,000 DHS personnel, searchable through the Icepick web front end hosted at icepi.cx and later migrated to a new domain and registrar after the serverHold action.

   Remediation

   Affected personnel should anticipate targeted phishing, social engineering and physical-safety risks stemming from exposed role and contact data. DHS said it will update the public as more information becomes available.

4. olhardigital.com.br ↗ · pub. 29/10/2026 09:36 · coletado 29/10 11:01

   DDoSecrets publishes 'Icepick' leak exposing 40,000+ DHS staff records from ICE, CBP and HSI

   ler a análise desta fonte ocultar

   The leak site Distributed Denial of Secrets (DDoSecrets) published a dataset dubbed Icepick containing records on more than 40,000 employees of the U.S. Department of Homeland Security (DHS), including names, phone numbers, emails and role information for personnel working in surveillance, intelligence and undercover operations. CBP staff make up over half of the records, while ICE accounts for roughly 10,000 accounts, about a third tied to Homeland Security Investigations (HSI). The data was attributed by DDoSecrets to a group calling itself Department of Peace, which claims it was obtained from the DHS Okta authentication system; Okta states it has no evidence its systems or data were compromised. DHS acknowledged a possible breach and said it is working to protect its employees. Reuters could not immediately verify the entire dataset but corroborated details for several individuals via credit records and phone calls.

   Technical Details

   Beyond directory data, the files expose permission groups governing access to internal systems, including groups referencing communications interception programs and certified undercover operations. Tools named in the records include Palantir Falcon and PenLink (phone and social media record analysis), as well as AI services such as ChatGPT, Gemini, Copilot and Grok. The dataset lists 39 HSI employees in certified undercover operation groups — one referencing surveillance of protest groups in Minneapolis — roughly 170 accounts tied to military processing support at ICE facilities, DoD and National Guard members, and about 4,400 contractors (IT staff, data scientists, nurses, correctional officers). Senior officials, including former secretary Kristi Noem, appear in groups exempt from departmental internet filtering. Researcher/journalist Maia Arson Crimew built a public search tool for the records.

   Remediation

   Affected personnel face elevated risk of targeted phishing, doxxing and physical-safety threats; organizations relying on Okta as an identity provider should review session, token and admin-access logging and enforce phishing-resistant MFA. DHS says it will release further information as it becomes available.

5. techcrunch.com ↗ · pub. 29/10/2026 10:43 · coletado 29/10 11:01

   DHS login system breach: 40,000 employee records leaked; Bluesky blocks DDoSecrets links as DHS sends takedowns

   ler a análise desta fonte ocultar

   A hacker obtained more than 40,000 user account records from the U.S. Department of Homeland Security login system, including names, work-issued phone numbers and email addresses of employees and agents of agencies such as CBP and ICE. The dataset was published by transparency collective DDoSecrets, and a searchable copy was built by journalist maia arson crimew. Bluesky began blocking links to the DDoSecrets site, flagging them as "malicious" and citing community guidelines, while DDoSecrets co-founder Emma Best argues the data contains only professional contact information. DHS said it is "aware of a potential breach" and is working to address it, and filed a takedown notice through security vendor ZeroFox, which is authorized to act on DHS's behalf until 2028. The searchable site's domain was placed on "serverHold" by its registrar (domain hosted via CentralNic), taking it offline, though a locally hosted copy of the data remains distributable.

   Technical Details

   • Breach of the DHS login/account system, exposing over 40,000 user account records.
   • Exposed fields resemble business-card data: names, work phone numbers, work email addresses, agency affiliation.
   • No home addresses or personal contact details per DDoSecrets.

   Remediation

   DHS has not disclosed the intrusion vector or remediation steps. Affected personnel should anticipate targeted phishing, vishing and social engineering using work contact details, and organizations should monitor for impersonation of DHS staff.

6. securityweek.com ↗ · pub. 29/10/2026 09:54 · coletado 29/10 11:00

   Threat actor 'Department of Peace' leaks 41,000+ DHS employee records, including system access mappings

   ler a análise desta fonte ocultar

   A threat actor using the handle Department of Peace has published a database of more than 41,000 US Department of Homeland Security employee records. The actor claims the data was stolen from an Okta single sign-on system used by DHS employees and contractors; Okta told SecurityWeek it has no evidence its data or systems were compromised. Most records reportedly cover CBP, ICE and HSI personnel, with roughly 1,000 CISA employees also included. Distributed Denial of Secrets, which obtained a copy it calls 'Icepick', says the data identifies officials running covert and undercover operations and key staff in rendition and deportation programs. DHS said it is aware of a potential breach and is working to address it.

   Technical Details

   The leaked records include names, work email addresses and phone numbers, job titles, office locations, and — most critically — mappings of which internal systems and applications each account can access. A searchable online tool for the data is also available. Researchers note the access-entitlement data provides adversaries with a targeting roadmap for follow-on phishing and lateral intrusion. The incident follows the ShinyHunters breach of FBI systems a month earlier and the hack of the Homeland Security Information Network (HSIN) three months prior.

   Remediation

   Affected personnel should anticipate targeted phishing and social engineering against high-privilege accounts; organizations should enforce phishing-resistant MFA on SSO, review Okta session and admin logs, and reassess exposure of entitlement data.

7. gbhackers.com ↗ · pub. 29/10/2026 02:10 · coletado 29/10 03:00

   Department of Peace Leak Exposes Personal Data of 41,000+ US DHS Employees, Including Undercover Staff

   ler a análise desta fonte ocultar

   Distributed Denial of Secrets (DDoSecrets) published a dataset on October 28 covering more than 40,000 US Department of Homeland Security employees. It attributed the data to an entity calling itself "Department of Peace". Per Reuters, the records include names, phone numbers, email addresses, job titles and internal email groups across ICE, CBP, Homeland Security Investigations and CISA. Some entries identify surveillance, computer forensics, special operations and undercover assignments, which raises the risk to personnel safety and the exposure of nonpublic organizational structures. Attribution and the extraction method remain unresolved.

   Technical Details

   • DDoSecrets co-founder Emma Best said the Department of Peace harvested the data from the Okta single sign-on service DHS uses. Reuters could not corroborate this.
   • Okta stated: "Okta is secure, and we have no evidence our data or systems were compromised." No Okta vulnerability or confirmed initial-access technique has been established, and a claim about a customer's identity environment does not show that the identity provider was compromised.
   • Reuters matched six employees' records against credit bureau data and previously exposed data in District 4 Labs, and confirmed phone numbers and other details with three DHS employees. One employee said the call was their first notice of a possible breach. These checks do not validate the full dataset.
   • Some data overlaps with LinkedIn profiles. Other records reportedly reveal nonpublic structures and previously undisclosed programs or operations.
   • Journalist and hacktivist Maia Arson built a searchable interface for the dataset, which also makes targeted reconnaissance and impersonation easier.
   • The article notes that identity-focused social engineering and vishing are relevant context but have not been linked to this incident.

   Remediation

   • Independently verify password and MFA reset requests, especially support-desk requests.
   • Review suspicious authenticator enrollments.
   • Correlate identity logs with unusual application access.
   • Brief exposed personnel about targeted calls and impersonation. These are precautionary measures; there is no evidence that exposed accounts have been compromised.
8. wired.com ↗ · pub. 29/10/2026 00:34 · coletado 29/10 01:01

   Bluesky blocks links to 'Icepick' leak of 41,000+ DHS employee and contractor records published by DDoSecrets

   ler a análise desta fonte ocultar

   Bluesky is blocking links to Icepick, an archive of records on more than 41,000 Department of Homeland Security (DHS) employees and contractors, and labels the pages "malicious". The archive was published by the transparency nonprofit Distributed Denial of Secrets (DDoSecrets). A group calling itself the Department of Peace gave it to DDoSecrets and to journalist maia arson crimew, who built a searchable website for the records. Bluesky says the files expose email addresses and phone numbers "shared without their authorization", in violation of its community guidelines. It chose to block the links rather than remove individual posts. Bluesky did not say whether the block was automatic or requested by a government agency.

   Technical Details

   • The records list names, contact information and membership in internal groups, tied in some cases to surveillance and undercover operations. WIRED found they lay out how DHS is organized, from senior leadership to individual immigration agents, and in some cases appear to show who has access to certain technologies.
   • A preview analyzed by WIRED apparently contained work-related contact details, which one expert compared to what is printed "on a business card".
   • The DDoSecrets homepage still loads from Bluesky, while crimew's search site is also blocked. The third-party app Klearsky opens the links without a warning, because Bluesky's open protocol lets outside apps choose which moderation labels to apply.
   • On X, the Grok chatbot pointed users to the Icepick site and said the full dataset can be downloaded from DDoSecrets or by torrent.
   • The article does not describe how the data was obtained.

   Remediation

   The article gives no remediation guidance. The exposed DHS staff face doxxing and targeting risks, and their organizations may want to review the exposure of personnel tied to sensitive operations.

9. cyberscoop.com ↗ · pub. 28/10/2026 18:33 · coletado 28/10 19:00

   Hacktivists leak data on 41,000+ DHS employees and contractors, claiming access via Okta SSO

   ler a análise desta fonte ocultar

   A leak site published on Wednesday exposes internal data on more than 41,000 Department of Homeland Security (DHS) employees and contractors. The hacktivist group Department of Peace claims it took the data from an Okta single sign-on service used at DHS, and passed it to Distributed Denial of Secrets (DDoSecrets) and the hacker maia arson crimew. The group said the breach was a response to DHS Secretary Markwayne Mullin's promise of stepped-up ICE operations. CyberScoop verified that numerous current CISA employees, and some former CISA leadership, appear in the data. Okta says it has no evidence its data or systems were compromised, and DHS had not commented.

   Technical Details

   • Claimed source: an Okta SSO service used at DHS. The claim is unverified, and Okta denies any compromise of its systems.
   • The dataset covers years of records, including group names that reference COVID-19 planning and 2023 internal summits.
   • It reportedly identifies personnel across multiple DHS components, including ICE, with email addresses and phone numbers. crimew built a search tool for the data.
   • The article does not describe the intrusion method or any IOCs.

   Remediation

   The article gives no remediation guidance. Affected organizations should treat the exposed staff data as a heightened phishing and doxxing risk, and should review their identity provider logs and SSO configuration.

10. wired.com ↗ · pub. 28/10/2026 17:00 · coletado 28/10 18:01

    Department of Peace leaks 'Icepick' archive exposing about 41,000 DHS personnel, including undercover HSI agents

    ler a análise desta fonte ocultar

    A group calling itself the Department of Peace leaked records on about 41,000 Department of Homeland Security (DHS) personnel across DHS and seven component agencies, including ICE, CBP, USCIS and CISA. Distributed Denial of Secrets (DDoSecrets) published the archive, named "Icepick", on Wednesday. It says the data comes from DHS's Okta login system, and the records were last updated on August 19, 2026. Okta says it has no evidence its data or systems were compromised, and the intrusion method has not been disclosed. The data reveals DHS's organizational structure, supervisors and access permissions, and includes personnel tied to certified undercover operations. Researcher maia arson crimew built a searchable website for the data. Recorded Future's Alexander Leslie called it, if authentic and current, an extraordinarily valuable intelligence resource for those seeking to penetrate DHS.

    Technical Details

    • Records cover about one seventh of the DHS workforce. CBP accounts for more than half, ICE about 10,000 (roughly a third in HSI), USCIS about 6,200 and CISA nearly 1,000 (more than half contractors).
    • The dataset lists over 55,000 permission groups. Most records name a supervisor, so reporting relationships across the department can be reconstructed.
    • 39 HSI employees belong to groups whose names include "CUC" (certified undercover operation). One group references "Keyhole", an undercover operation tied to HSI surveillance of Minneapolis protest groups.
    • Group names reference surveillance and investigative tooling, including Palantir Falcon, PenLink, Mobile Fortify (face recognition), wiretap and intercept programs, and AI tools (ChatGPT, Gemini, Copilot, Grok).
    • The leak includes senior leadership such as former DHS head Kristi Noem, 145 contractors flagged as "contractor" or "high risk contractor", Department of Defense personnel, National Guard members and 287(g) local law enforcement officers.
    • Leslie warns that correlating the dataset with previously compromised and commercial data would enable targeting of vulnerable personnel, convincing impersonation and compromise of ongoing investigations.
    • The Department of Peace note reads: "They have our information, so it's only fair that we have theirs." The publishers frame the leak as accountability, not doxing.

    Remediation

    The article gives no official remediation. The authenticity and currency of the data are unconfirmed, and DHS and DOJ did not respond. Defenders should treat the exposed personnel as exposed to targeted phishing and impersonation.

11. techcrunch.com ↗ · pub. 28/10/2026 17:01 · coletado 28/10 18:00 primeiro registro

    Hacker 'Department of Peace' leaks personnel data of 40,000+ DHS employees, allegedly taken from Okta SSO

    ler a análise desta fonte ocultar

    A hacker using the handle Department of Peace claims to have stolen data on more than 40,000 Department of Homeland Security (DHS) employees from an Okta single sign-on system and published it online. The dataset includes names, job titles, work email addresses, cell phone numbers and office locations. It covers roughly 21,000 CBP staff, 10,000 ICE/HSI staff and just under 1,000 CISA staff, plus other DHS components. The data reached journalist maia arson crimew and was then shared with DDoSecrets. TechCrunch verified a portion of it as authentic, and record timestamps suggest exfiltration around mid-August 2026. The same actor previously claimed a separate DHS breach involving thousands of contracts with private-sector vendors. DHS did not respond, and Okta said it has no evidence its own data or systems were compromised.

    Technical Details

    • The data allegedly comes from DHS's Okta SSO tenant, which employees and contractors use to log in to the central network. It also holds IT and log-in records and Active Directory group memberships.
    • The group memberships reveal tooling access, including Microsoft 365, Citrix and Adobe Acrobat. They also show around 4,500 users in a "Headspace_users" group, dozens of Penlink groups (including Penlink PLX, with some groups exceeding 2,000 HSI users), 200+ CBP users tied to the Mobile Fortify facial-recognition app, ChatGPT access groups, and groups tied to Salt Typhoon and Volt Typhoon investigations.
    • The leaked records equal about one-fifth of DHS's roughly 220,000 staff.
    • The attack vector is not disclosed, and it is unclear whether the underlying vulnerability has been fixed or whether DHS knows of the theft.

    Remediation

    The article gives no official remediation guidance. Exposed staff face elevated risk of targeted phishing, doxxing and social engineering, and the leaked group data could help an attacker map internal access. Defenders should review SSO/Okta tenant logs and session and token hygiene, and warn affected personnel.