---
title: Directory data on about 41,000 DHS employees and contractors, including some 21,000 CBP and 10,000 ICE/HSI staff, is published as the "Icepick" leak; DHS says it is aware of a potential breach | ctxsec
url: https://ctxsec.com/items/dhs-icepick-okta-directory-41k-personnel-leak
description: ""
status: "confirmed breach report (TechCrunch verified a portion of the data; DHS says it \"is aware of a potential breach\"); Okta says its own systems were not compromised; how the data was taken is unconfirmed"
published: 2026-10-28
---

> 

[← Cybersecurity News](/news) · [markdown](/items/dhs-icepick-okta-directory-41k-personnel-leak.md)

confirmed breach report (TechCrunch verified a portion of the data; DHS says it "is aware of a potential breach"); Okta says its own systems were not compromised; how the data was taken is unconfirmed

2026-10-28

### Directory data on about 41,000 DHS employees and contractors, including some 21,000 CBP and 10,000 ICE/HSI staff, is published as the "Icepick" leak; DHS says it is aware of a potential breach

A hacker using the name "Department of Peace" says it took the records from the Okta single sign-on system that Homeland Security staff and contractors use to log in to the department network. The data was given to maia arson crimew, who shared it with the leak-hosting nonprofit DDoSecrets, which published it on Oct 28. TechCrunch matched the names of several known DHS employees against an offline copy and says the data appears authentic. Record timestamps suggest it was taken around mid-August 2026.

- **Who is in it:** more than 21,000 CBP records, about 10,000 for ICE and its HSI unit, just under 1,000 at CISA, plus headquarters, USCIS and Federal Protective Service staff. That is roughly a fifth of the DHS workforce.
- **What it holds:** names, job titles, work email, cell phone numbers and office locations, plus Active Directory group memberships that show which internal systems and third-party tools each user can reach.
- **Statements:** DHS told TechCrunch it "is aware of a potential breach and is actively working to address the situation". Okta said it has "no evidence our data or systems were compromised". It is not known how the attacker got in or whether that path is closed.

**What to do:** expect targeted phishing, vishing and harassment of the people listed, and of contractors whose names now sit beside system-access groups. Any organization that federates with an identity provider should check for unusual directory-wide reads by a single account or API token, since a bulk export of user and group objects is what a leak like this looks like in the logs.

Sources: [TechCrunch: Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents (Oct 28, with DHS and Okta statements)](https://techcrunch.com/2026/10/28/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-agents/)