Defence & Security1 Nov 2026 · about 6 min

A hacker stole more than 40,000 DHS employee records

The brief

The breach exposed direct identifying and contact information for more than 41,000 Department of Homeland Security employees. The stolen fields included names, job titles, phone numbers, email addresses, and office locations. That combination can connect individuals to their work and agency roles. CBP and ICE employees made up large portions of the dataset. Around 21,000 records belonged to CBP staff, while nearly 7,000 belonged to ICE. Other records came from the Cybersecurity and Infrastructure Security Agency, US Citizenship and Immigration Services, and Homeland Security Investigations. The data was reportedly obtained through Okta, a service DHS used for identity and access management. The leaked dataset, called “Icepick,” was shared with Distributed Denial of Secrets and is being hosted there. The article does not state that every record was equally complete or describe specific harm to individual employees.

What personal information was stolen, and which DHS agencies and employees were affected?

CBP and ICE employees made up large portions of the dataset. Around 21,000 records belonged to CBP staff, while nearly 7,000 belonged to ICE. Other records came from the Cybersecurity and Infrastructure Security Agency, US Citizenship and Immigration Services, and Homeland Security Investigations.

The data was reportedly obtained through Okta, a service DHS used for identity and access management. The leaked dataset, called “Icepick,” was shared with Distributed Denial of Secrets and is being hosted there. The article does not state that every record was equally complete or describe specific harm to individual employees.

How many employee records were exposed, and how were they distributed among CBP, ICE, and other DHS agencies?

The breach exposed more than 40,000 DHS employee records, with the article also describing the total as more than 41,000. Its largest identified group was CBP, which accounted for around 21,000 records. ICE accounted for nearly 7,000 records.

The dataset also covered employees at several other DHS organizations. These included CISA, USCIS, and HSI. The article does not provide a separate count for each of those agencies, so their combined total cannot be broken down precisely from the available figures.

The distribution shows that the incident reached well beyond one office or agency. It included both major enforcement agencies and cybersecurity, immigration-services, and investigative organizations. The records were reportedly stolen through Okta, a DHS identity and access management service. The exposed dataset is known as “Icepick.”

What is Okta, and how was it connected to the hacker’s access to the DHS data?

Okta is an identity and access management service. Organizations use such services to manage user identities and control access to digital systems. In this case, the Department of Homeland Security used Okta as part of its access infrastructure.

According to TechCrunch, a hacker known as “Department of Peace” gained access to the DHS data through Okta. The article does not explain the exact technical method used after that access. It does identify Okta as the route connected to the stolen employee records.

That connection matters because an access-management service can sit between employees and many organizational systems. If an attacker reaches an account or service with broad permissions, sensitive information may become available. The breach reportedly included records from CBP, ICE, CISA, USCIS, and HSI. The stolen data was later shared with DDoSecrets.

What could happen to DHS employees when their names, contact details, job titles, and office locations become public?

Publishing names alongside phone numbers, email addresses, job titles, and office locations removes much of the separation between employees and the public. It can make individual workers easier to identify, contact, or associate with particular government duties. The article does not document specific injuries or threats resulting from this breach.

The risk is especially clear because the records connect people with agencies such as ICE, CBP, CISA, USCIS, and HSI. A public list can also reveal which offices or employees belong to particular parts of DHS. The leaked information reportedly included more than 41,000 records.

The dataset was reportedly shared with DDoSecrets, which is hosting the “Icepick” collection. The article notes that DHS had worked to conceal some CBP and ICE identities. It does not say what protective steps DHS took after the breach, and the department had not immediately responded to a request for comment.

Why were the identities of ICE and CBP personnel especially sensitive in light of their enforcement activities?

ICE and CBP identities were especially sensitive because the agencies carried out anti-immigration raids around the United States. The article also says DHS worked to conceal the identities of their agents. That makes a public employee list notable beyond an ordinary workplace directory.

The article links these agencies to efforts to track down online critics. It presents the leak as a reversal of that information imbalance. The hacker known as “Department of Peace” said, “They have our information, so it’s only fair that we have theirs,” according to TechCrunch.

The breach therefore exposed people connected with enforcement activities that the article describes as politically and publicly contentious. It included names, contact details, job titles, and office locations. The article does not state that any particular employee was harmed, nor does it explain whether agents changed duties or identities after the leak.

What are Mobile Fortify and PenLink, and why would information linking DHS groups to surveillance tools matter?

Mobile Fortify and PenLink are surveillance-related tools named in the leaked DHS information. The article describes Mobile Fortify as a facial recognition app. It says PenLink can collect and analyze data from phones and online services.

The leak reportedly linked DHS groups to these tools. That connection could show which parts of the department had access to particular surveillance capabilities, rather than merely listing employee contact information. The article does not identify every group’s specific tool access or describe how the tools were used in individual cases.

The information matters because the dataset combined personnel records with details about agency capabilities. It reportedly included employees from CBP, ICE, CISA, USCIS, and HSI. Cybersecurity researcher maia arson crimew reportedly shared the data with DDoSecrets, which is hosting the “Icepick” dataset. DHS had not immediately responded to a request for comment.

How do identity and access management systems determine who can enter an organization’s digital systems and what information they can use?

Identity and access management systems organize digital entry. They identify users, check whether they are authorized, and apply permissions to systems or information. The goal is to give each person access suited to their role, rather than opening every system to everyone.

In practice, an organization can connect a person’s identity with approved applications, accounts, or records. The system then allows or blocks access based on those settings. The article identifies Okta as the identity and access management service used by DHS, but it does not explain DHS’s specific permission rules.

According to TechCrunch, the hacker known as “Department of Peace” gained access to DHS data through Okta. That makes the service part of the breach’s access path. The exposed information included records from CBP, ICE, CISA, USCIS, and HSI. The article does not state exactly which account, permission, or technical weakness enabled the access.

This brief was written by AI from the original reporting and checked by other models. Names, figures and quotes come from the source; read it for full context.