DHS leak of 41,000 workers came via Okta login, DDOSecrets says
A leak exposes data on more than 41,000 Department of Homeland Security employees and contractors, including undercover ICE and CBP agents, with names, phone numbers, emails, and locations. A group calling itself Department of Peace claimed the publication, which per WIRED includes internal groups tied to surveillance, Palantir, and xAI Grok. DHS has not confirmed the attack.
What happened
A hacker using the handle Department of Peace published records of more than 41,000 U.S. Department of Homeland Security employees. The dataset holds names, job titles, work emails, cell numbers and office locations, including CBP and ICE agents and undercover officers. DHS says it is aware of a potential breach and is working to address it.
Why it matters
TechCrunch verified part of the data as authentic; the leak covers about one-fifth of DHS staff. Beyond personal data, it shows which systems and apps each account can access, which Illumio's public sector CTO calls a roadmap for follow-on attacks. Exposed contacts enable targeted phishing and scams.
What to do
Check whether your employees' or partners' data appears in circulating copies. Monitor exposed corporate emails and phones for phishing. Review sessions, privileges and directory exports in your single sign-on provider.
For the technical team
- Affected
- Governo dos EUA (Department of Homeland Security) Dados pessoais de cerca de 41 mil servidores do Department of Homeland Security, incluindo agentes infiltrados da ICE e da CBP e registros de órgãos como a CISA; nomes, e-mails profissionais, números · More than 41,000 records of DHS employees and contractors: about 21,000 CBP, 10,000 ICE and HSI, just under 1,000 CISA, plus headquarters, USCIS and FPS (TechCrunch/SecurityWeek); roughly one-fifth of DHS's roughly 220,000 staff.
- Exploitation
- Published by DDoSecrets as 'Icepick', with a public search tool built by maia arson crimew; TechCrunch verified a portion as authentic. DHS says it is aware of a potential breach; Okta denies compromise. The search site's domain was placed on serverHold by its registrar after a DHS takedown notice filed via ZeroFox; Bluesky blocks the links; a locally hosted copy exists.
- Fix
- No fix disclosed; TechCrunch says it is unclear whether the vulnerability has been fixed. DHS says it is actively working to address the situation.
- Vector
- Per the hacker, the data came from DHS's Okta single sign-on system used by employees and contractors to reach the central network; records included IT and log-in data, permissions and Active Directory group memberships. Okta denies compromise: it says there is no evidence its data or systems were breached. TechCrunch says it is unclear whether the vulnerability that allowed the breach has been fixed; timestamps suggest exfiltration around mid-August.
- More details
- The data was given to journalist and hacker maia arson crimew, who shared a copy with DDoSecrets. The dataset exposes Active Directory groups: Microsoft 365, Citrix, Adobe, 'Headspace_users' (about 4,500 users), Penlink and Penlink PLX (web surveillance), Mobile Fortify (facial recognition, more than 200 CBP users), ChatGPT access, and groups tied to Salt Typhoon and Volt Typhoon investigations. It is the second DHS breach this year claimed by the same hacker (contracts); it follows the FBI breach by ShinyHunters one month earlier and the HSIN hack three months earlier. DDoSecrets says the data identifies officials running covert and undercover operations and key staff in rendition and deportation programs. ZeroFox has authority to act for DHS until 2028.
Timeline
DDoSecrets named the published archive 'Icepick'; the DHS Okta login data was reportedly obtained by a group calling itself the Department of Peace.
New posts attribute the leak to a group calling itself 'Department of Peace' and break down those exposed: more than 21,000 CBP records and thousands of ICE and HSI agents, with one post citing nearly 6,600 ICE agents.
Bluesky has blocked links to the site publishing the leaked DHS employee data, which identifies thousands of ICE agents, as the U.S. government seeks takedowns.
Want the next updates in your inbox? Get the daily edition →
See all 14 updates
SecurityWeek reports the personal and work data was allegedly stolen from an Okta single sign-on system earlier this year.
A group calling itself the 'Department of Peace' claims the leak, published by DDOSecrets with a public search tool exposing names, phone numbers, emails and job titles.
Bluesky now blocks links to the Icepick leak as malicious, while on X Grok pointed users to a searchable web tool and torrents of the full archive.
X post highlights the leak of personal data on 41,000 ICE agents and contractors, already tracked in the DHS incident.
Batch identifies the group behind the publication, calling itself 'Department of Peace', and adds WIRED details: phone numbers, facility locations, and internal groups tied to surveillance, Palantir, and xAI Grok; DHS has not confirmed the attack.
New posts detail the leak: identities and contact information of nearly 6,600 ICE agents and more than 21,000 Border Patrol and Customs personnel; anti-ICE protesters claim credit, according to NBC.
Post reports a Swiss hacker publicly identified thousands of ICE agents from the leaked data.
A group calling itself Department of Peace claims the compromise of a DHS system; the dataset reportedly spans ICE, CBP, CISA and other agencies, with names, work emails, cellphone numbers, job assignments and facility locations.
New post highlights the leak's scope: identities, contact details and job assignments of more than 40,000 DHS employees, including ICE and CBP agents and those working undercover.
Wired raises the count to about 41,000 people and details numbers and groups tied to Palantir and Grok; DDOSecrets attributes the origin to DHS's Okta login, which Okta denies.
Incident opened.
Sources 15 sources
- Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents TechCrunch Security
- @IntCyberDigest @IntCyberDigest
- @IntCyberDigest @IntCyberDigest
- @MikaelThalen @MikaelThalen
- @DarkWebInformer @DarkWebInformer
See all 18 sources
- @PabloReports @PabloReports
- @krassenstein @krassenstein
- @Polymarket @Polymarket
- @allenanalysis @allenanalysis
- @UHN_Plus @UHN_Plus
- @asukagrypr @asukagrypr
- @IntCyberDigest @IntCyberDigest
- @MarioNawfal @MarioNawfal
- Over 41,000 DHS Employee Records Leaked Online SecurityWeek
- Bluesky blocks links to leaked DHS employee data as government seeks takedowns TechCrunch Security
- @ThePatriotOasis @ThePatriotOasis
- @YourAnonOne @YourAnonOne
- @DropSiteNews @DropSiteNews
