Icepick: DHS/Okta SSO — hacktivists leak 41,000 DHS employee records incl. undercover ICE agents
Severity: high · Patch status: no-fix-needed · Since 2026-10-29
A hacktivist group calling itself the Department of Peace leaked records of more than 41,000 DHS employees — names, offices, contact details and assignments — to DDoSecrets and hacker maia arson crimew, who published the 'Icepick' dataset on October 28, 2026. The group says the data came from an Okta single sign-on service used by DHS; Okta denies its systems were breached. Reuters verified details for several employees. A searchable tool at icepi.cx indexes 41,191 people and 55,603 internal groups, exposing HSI certified undercover agents, use-of-force instructors tied to ICE shootings, and operational group names. DHS says it is aware of a potential breach and is investigating. This is the third major federal data leak in about a month, following FBI and Pentagon incidents.
What to do
- Treat leaked DHS contact data as public; assume targeted phishing, doxxing and social engineering against staff, especially those in undercover or sensitive roles
- Review and rotate credentials, tokens and sessions tied to the affected Okta SSO tenant; audit for unauthorized access
- Harden identity provider logging, MFA and privileged access monitoring across DHS agencies
- Assess operational risk to personnel named in undercover, use-of-force and intelligence groups and consider protective measures
- Monitor for follow-on leaks or extortion referencing the dataset
Sources
All live incidents on Threat Watch
