Hacktivist leak exposes records of more than 41,000 DHS staff, including undercover ICE agents
- Severity
- High
- Sources
- 3
What happened
The Icepick archive, published by DDoSecrets, reportedly originates from DHS's Okta single sign-on system and was last updated on August 19, 2026. It covers more than 41,000 staff and contractors across DHS and seven components, including ICE and CBP, with contact details, facility locations, group memberships tied to wiretap programmes, Palantir software and xAI's Grok chatbot, and references to internal systems. The articles give no CVE, no initial access method and no remediation advice. Defenders should treat the leaked identity data as enabling phishing, social engineering and physical targeting, and should review Okta tenant access and credential exposure.
For security analysts · Written by AI from 3 sources · Wrong?
What to do
- If you have an account with the company, change that password, and anywhere you used the same one.
- Turn on two-step sign-in where you can.
- Expect scam emails and texts that mention the breach: contact the company yourself, not through links.
General advice for this kind of story
Full story timeline · 3 updates
- Wed 28 OctoberMassive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE AgentsWired (Security)
- Thu 29 OctoberHacktivists leak 41,000 DHS staff records, revealing undercover ICE agentsHelp Net Security
- Massive leak exposes 41,000 DHS workers and undercover ICE agentsArs Technica (Security)
Who reported · 3 outlets
Who and what is in it
Companies