DHS "Icepick" Leak: 41,000 Staff Records Reportedly Taken from an Okta SSO Directory

On October 28, 2026, a hacktivist group calling itself "Department of Peace" released records on more than 41,000 current and former U.S. Department of Homeland Security employees and contractors, which it says came from an Okta single sign-on system DHS uses. The exposed fields include reporting lines and 55,000+ access-group memberships, turning a staff list into an access map; DHS calls it a "potential breach" and Okta says its own systems were not compromised.

TL;DR

The dataset covers 41,191 DHS personnel across nine components, according to Cybernews. More than half of the records are CBP; about 980 are CISA staff. The records were reportedly exfiltrated around mid-August 2026.
The most dangerous part is the access data: more than 55,000 permission groups showing which internal tools, vendors and programmes each account is tied to. Experts quoted by SecurityWeek and WIRED call this a roadmap for attackers.
How the data was taken is not publicly known. The Okta source is the hacker's claim only; Okta denies any compromise of its platform and Reuters could not corroborate it. For CISOs, the lesson is that an SSO/IdP directory is high-value targeting intelligence in its own right.

What happened

Date (2026)	Event	Source
March 2	The same hacker claimed an earlier theft of thousands of DHS contracts with private companies.	TechCrunch
July 17	DHS Secretary Markwayne Mullin remarked on "turning up the heat" on immigration enforcement; the group later cited this as its motive.	Government Executive, Cybernews
Mid-August (about Aug 19)	Record timestamps suggest exfiltration around mid-August (TechCrunch); TNW reports a last-update date of Aug 19.	TechCrunch, TNW
Oct 28	WIRED, TechCrunch and Reuters reported the leak. DDoSecrets published the "Icepick" archive (about 166.7 MB), and a searchable front end appeared. Okta said it has no evidence of compromise.	TechCrunch, DDoSecrets, TNW
Oct 29	DHS said it is "aware of a potential breach". DHS filed a takedown via ZeroFox and the registrar put the search site on hold; Bluesky began blocking links to the archive.	Government Executive, SecurityWeek (via Yahoo), TNW
As of Oct 30	The intrusion method has not been disclosed. Whether the access path is closed, or whether DHS knew before publication, is not publicly known.	TechCrunch

Technical analysis / attack path

Claimed source: the Okta SSO tenant DHS employees and contractors use to sign in. Neither DHS nor Okta has confirmed this; Okta says it has no evidence its data or systems were compromised.
Intrusion vector: not publicly known. Reporting does not establish whether the data came from a stolen admin or API token, a synced directory, a connected app or a misconfiguration. Treat each as an open hypothesis, not a finding.
What was exposed (Cybernews, TechCrunch): full name, title, agency, component, office, work email and phone numbers; manager and direct reports; employment status (employee, associate, contractor); AD/Okta group memberships and record timestamps.
Why the group data matters: WIRED (via TNW) counted 55,000+ permission groups, including ones referencing Microsoft 365, Citrix, Adobe, ChatGPT, Gemini, Copilot, Palantir Falcon and PenLink. More than 200 CBP accounts sit in a group tied to the Mobile Fortify facial-recognition app; 39 HSI users are in groups containing "CUC" (certified undercover operation, per court filings); some groups relate to Salt Typhoon and Volt Typhoon investigations.
Not in the data: per DDoSecrets co-founder Emma Best (via TNW), no home addresses or personal contact details. No passwords, MFA secrets or tokens have been reported.
Data quality: some records are historical (former CISA staff, per Nextgov/FCW); the search tool is described as not comprehensive.

Why it happened

Root cause: not publicly known; no official root-cause statement.
Motive: the group frames the leak as retaliation for stepped-up immigration enforcement.
Pattern: reporting places this in a run of 2026 incidents against government personnel data, including ShinyHunters' claimed FBI personnel data theft (September), a Defense Manpower Data Center breach affecting about 3 million people, and a Homeland Security Information Network intrusion (Government Executive, TNW, TechCrunch).
Structural point (inference from the exposed fields, not a confirmed cause): an identity provider directory combines who people are, who they report to and what they can access. Anyone who can read it gets an org chart and an access map in one query.

Who is affected

By component (Cybernews, 41,191 total): CBP 21,329 · ICE 6,598 · USCIS 6,245 · HSI 3,421 · DHS HQ 1,755 · CISA 980 · FPS 394 · FLETC 337 · S&T 132.
Where sources differ: TechCrunch and WIRED put ICE at about 10,000 including HSI; BBC (via TNW) counted nearly 6,600 for ICE alone. Share of workforce: about one-fifth (TechCrunch, Cybernews) vs about one-seventh (WIRED via TNW).
Contractors are included; more than half of the CISA records are contractors (WIRED via TNW).
Vendors named in group memberships are exposed as DHS suppliers or users.

How it affects CISOs

The IdP is a crown-jewel data store, not just an auth service. Directory, group and app-assignment data is reconnaissance gold even when no credentials leak.
Precise social engineering gets easier. With titles, managers, phone numbers and app entitlements, attackers can impersonate a manager or the help desk convincingly.
Supply-chain exposure: if you sell to the public sector, your product's group names can reveal customer relationships; if you employ former government staff, their exposure becomes your phishing risk.
Attribution ambiguity is normal. When a breach names a major SaaS IdP and the vendor denies it, the customer owns the investigation.
Takedowns have limits. The registrar takedown hit only the search site; the archive remained downloadable via torrent, per DDoSecrets.

What to do

Immediate (24h)

Pull IdP system logs for bulk reads of users, groups and app assignments over the last 90+ days, by admins and API tokens. Flag unfamiliar sources, off-hours activity and new integrations.
Inventory every API token, OAuth/service app and directory-sync agent with read access to the IdP directory. Revoke anything unowned or stale; rotate long-lived tokens.
If you have DHS-facing staff or contracts, brief them and your help desk on pretexting that uses accurate org-chart detail. Enforce call-back verification for resets and MFA changes.

This week

Make IdP admin roles phishing-resistant (FIDO2), time-bound and separate from daily-use accounts. Alert on admin role grants and new API token creation.
Review least-privilege scopes of every integration that reads your directory: HR, ITSM, SIEM connectors, SCIM provisioning, AD agents.
Audit group naming; avoid names that reveal sensitive programmes, vendors or operations.
Tabletop: "Our full directory and entitlement map is public. What do attackers target first?"

Strategic

Classify identity directory and entitlement data as sensitive, with DLP, retention and export controls.
Deprovision former employees and contractors promptly; stale identities widen exposure.
Add identity threat detection and response (ITDR) and continuous testing that covers the IdP control plane and SaaS-to-SaaS integrations.
Pre-negotiate IdP vendor obligations for evidence-sharing and log retention.

Questions to ask your team and vendors

Who and what (humans, tokens, apps) can enumerate our entire user and group directory today, and when did each last do it?
How long do we retain IdP logs, and could we prove or disprove a bulk export from three months ago?
Which group names would reveal sensitive projects, vendors or high-risk roles if published?
How many former users and contractors still exist in the IdP or AD with group memberships intact?
To our IdP vendor: what tenant-level telemetry can show whether an export came from your platform or a customer-side integration?
To our help desk: what verification stops an attacker who knows a user's manager, title, phone number and apps?

Sources

Discuss: Is your identity provider's directory and entitlement data classified and monitored as a crown-jewel asset? Could you prove from logs whether someone bulk-exported it last quarter?

Is your IdP directory one export away from becoming an attacker's map?

CISO Platform members are comparing how they log, scope and alert on identity-provider directory access after Icepick. Join to see the peer playbook and get the weekly threat briefing.

Join CISO Platform (free for security leaders) →

All Articles