Hackers leak the personal data of 41,000+ DHS employees and contractors, including CBP and ICE agents; DDoSecrets says the data came from DHS' Okta login system

Your personal work information, if you are a DHS employee or contractor, is now publicly available, increasing your exposure to targeted attacks.

Hackers associated with the transparency group DDoSecrets have leaked personal data belonging to over 41,000 employees and contractors of the U.S. Department of Homeland Security (DHS). The leaked archive, named "Icepick," reportedly originates from DHS's Okta login system and includes individuals from various component agencies like Immigration and Customs Enforcement (ICE) and U.S. Customs and Border Protection (CBP). The data, last updated on August 19, 2026, comprises employee names, job titles, and access permissions to internal systems. A cybersecurity researcher and journalist, maia arson crimew, previewed the data and published a searchable version. Okta has stated it has no evidence of its own systems being compromised, asserting its security. The leak occurs amidst increased DHS efforts to pursue critics and unmask anonymous social media users, contrasting with the agency's historical moves to conceal employee information.

The leaked dataset offers an unprecedented view into DHS's internal structure, including specific permission groups, access to sensitive tools like Palantir and PenLink, and even designations for undercover operations. This granular information, if authentic, could be a goldmine for adversaries seeking to exploit vulnerabilities within the department, enabling detailed impersonation attempts or compromising ongoing investigations. The inclusion of groups referencing AI tools like ChatGPT and Gemini, alongside encrypted messaging apps and facial recognition software, highlights the modern technological landscape DHS operates within and the potential attack vectors it presents.

This incident underscores a growing trend of data breaches targeting critical infrastructure and government agencies, potentially shifting the landscape of cyber warfare and espionage. The attackers' stated motivation, to hold DHS accountable, reflects a growing societal demand for transparency from powerful government entities, even at the risk of exposing sensitive employee data. The DHS's own recent actions to unmask critics and expand the definition of doxing create a complex and potentially hypocritical backdrop for this leak, suggesting a heightened state of digital conflict between government agencies and those who seek to scrutinize them.