The DHS Employee Data Breach

The story so far

As of October 29, 2026

A cache of records on more than 41,000 people who work for the Department of Homeland Security is now online, posted as a searchable database called Icepick. The files list names, work phone numbers and emails, office locations, supervisors, and the internal groups that govern what systems a person can use. A group calling itself the Department of Peace says it pulled the data from the department’s Okta single sign‑on system, a login that lets one account open many internal apps. Okta says it has no evidence its own systems were compromised. The department says it is aware of a potential breach and is working to address it and protect employees.

What turns this from a big directory into a security problem is the metadata. The records describe access groups and tools tied to undercover and surveillance work, wiretap programs, and investigative platforms. They appear current, with updates through mid‑August, and map reporting lines by listing managers. More than half of the entries relate to Customs and Border Protection personnel, about 10,000 to Immigration and Customs Enforcement (including Homeland Security Investigations), roughly 6,200 to Citizenship and Immigration Services, and close to 1,000 to the cybersecurity agency. That mix, plus references to thousands of internal permission groups, gives adversaries a blueprint for phishing, impersonation, and identifying sensitive roles, and could complicate ongoing investigations and field operations.

The data is circulating even as distribution narrows at the edges. The nonprofit that hosts government leaks published the archive, but a separate site that made the records easy to search went offline after its domain was put on hold by its registrar. Social network Bluesky is blocking links to the archive and related search tools under its rules against posting personal contact details, while leaving discussion of the leak in place. Portions of the dataset match known department personnel, which strengthens the assumption that a large share of it is real.

The stakes now are twofold. First, containment and damage control: identifying who in the files faces immediate safety or operational risk, and hardening accounts and systems against targeted scams that the directory enables. Second, attribution and access: whether the entry point was stolen credentials or a flaw in how the department used its identity provider, and whether that access persists. The fact that the files expose not just people but how the department’s systems are structured is the fact that explains the rest, from urgent internal reviews to platforms throttling direct access to the records.