Hacktivists publish personal data on more than 41,000 Homeland Security employees

A hacktivist group calling itself Department of Peace has published personal and professional data on more than 41,000 current and former employees and contractors of the U.S. Department of Homeland Security, in a leak distributed on October 28 through the transparency nonprofit Distributed Denial of Secrets, known as DDoSecrets. The group says it pulled the records from Okta, the single sign-on service DHS staff use to log into the department's network, though the breach has not been independently confirmed and Okta disputes that its systems were compromised.

The dataset, which DDoSecrets calls "Icepick," was built into a searchable public database covering 41,191 people and more than 55,000 internal access groups, according to reporting from Help Net Security. Roughly 21,000 of the records belong to U.S. Customs and Border Protection staff, about 10,000 to Immigration and Customs Enforcement, including its Homeland Security Investigations unit, and just under 1,000 to the Cybersecurity and Infrastructure Security Agency, with the remainder spread across DHS headquarters, U.S. Citizenship and Immigration Services and the Federal Protective Service, per SecurityWeek. That is about one-fifth of DHS's roughly 220,000-person workforce.

Exposed fields include names, job titles, work email addresses, cell phone numbers and office locations, along with Active Directory group memberships that show which internal systems, software and contractor tools each employee could access. The hacker's note accompanying the release read, "They have our information, so it's only fair that we have theirs," according to TechCrunch, which first reported the leak and verified part of the dataset by matching names of known employees against an offline copy of the database.

• Names, titles, work emails, cell numbers and office locations for more than 41,000 DHS personnel
• Okta single sign-on and Active Directory records showing internal system access by user
• Groups tied to facial-recognition tools, surveillance vendors and counterintelligence investigations
• No confirmation yet from DHS on how the data was obtained or how many records are current

How the data was reportedly obtained

The hacker group told reporters the material came out of DHS's Okta deployment, the identity platform federal agencies increasingly rely on to centralize employee logins. Okta, for its part, told multiple outlets it found no sign of a breach on its end: "Okta is secure, and we have no evidence our data or systems were compromised," a spokesperson said, as quoted by Nextgov/FCW. A DHS spokesperson said the department "is aware of a potential breach and is actively working to address the situation swiftly and effectively," and that it would share more information once available.

Centralized sign-on tools like Okta's are precisely what federal technology policy has been pushing agencies toward. A federal Enterprise Single Sign-On Playbook, maintained jointly by the General Services Administration and the Federal CISO Council, directs agencies to centralize authentication behind a single trusted platform capable of enforcing phishing-resistant multi-factor login — but the same document warns that centralization "concentrates risk," since a compromised sign-on layer can expose which systems an entire workforce is entitled to reach. A separate White House directive, OMB memo M-26-18, issued in August, pushes agencies toward consolidating sign-on infrastructure further, through Login.gov, for public-facing services. The Cybersecurity and Infrastructure Security Agency has separately urged organizations for several years to close technical gaps in single sign-on and multi-factor adoption, in joint guidance with the National Security Agency.

Who is named in the data

DHS is organized into more than a dozen components, including CBP, ICE, CISA and USCIS, and the leak touches staff across most of them. According to TechCrunch's review of the dataset, roughly 4,500 users — including ICE agents and deportation officers — belong to an access group referencing the meditation app Headspace, which held an $82,500 ICE contract that ended in 2023; the company says it has provided no services to DHS or ICE since. Dozens of other groups reference Penlink, a surveillance vendor with a long-running ICE contract, including one group covering more than 2,000 Homeland Security Investigations users. More than 200 CBP accounts are linked to Mobile Fortify, a facial-recognition app used by CBP and ICE in the field. Other groups in the data reference investigations into the China-linked hacking campaigns known as Salt Typhoon and Volt Typhoon, and some senior officials' accounts show access to ChatGPT.

This is the second time this year the same hacker has targeted DHS. In March, Department of Peace claimed to have taken thousands of DHS contract records covering more than 6,600 companies that do business with the department, a batch of documents also published through DDoSecrets. The new leak follows other recent breaches of federal personnel systems, including a claimed theft of FBI employee and applicant data by the extortion group ShinyHunters in late September, and a Defense Department file-sharing vulnerability that exposed Social Security numbers and other details for more than 3 million people.

Reaction

A spokesperson for Department of Peace linked the leak to public remarks by DHS Secretary Markwayne Mullin. "On July 17th, Markwayne Mullin said he was 'turning up the heat.' This is what happens to ICE when you do that," the spokesperson said, according to Nextgov/FCW's reporting.

"They have our information, so it's only fair that we have theirs."

DDoSecrets co-founder Emma Best said the dataset would serve as "a catalyst for investigations, empowering journalists," arguing it shows links between officials who oversee covert operations and staff involved in deportation programs. Ryan Shapiro, executive director of the public-records group Property of the People, said contact information of this kind often determines whether public-records requests succeed, and called the need for such tools urgent given the administration's approach to transparency. Gary Barlet, public sector chief technology officer at the security firm Illumio, told SecurityWeek that the access-group data is the most concerning part of the leak, since it could function as a target list showing attackers which systems and employees to go after.

What's next

DHS has not said whether it has confirmed the hacker's account of how the data was obtained, revoked access tied to the exposed accounts, or notified affected staff individually. Okta's denial leaves open the question of whether the records were pulled through a misconfigured permission, stolen credentials, a contractor system, or compiled from multiple sources — a distinction that will shape any eventual government response. Given the department's history of under-disclosed breaches, the more concrete test is likely to be whether DHS issues a public accounting of scope and cause, or whether, as with March's contractor leak, the agency lets the hacker's claims stand unanswered. Congressional oversight committees, which have previously pressed DHS and CISA after smaller personnel leaks, are likely next to weigh in.