Hacktivists have published personal details of more than 40,000 Department of Homeland Security (DHS) employees, according to reporting by NPR and Reuters. The data reportedly includes staff linked to undercover and surveillance work, which raises physical-safety and counter-intelligence risks that go beyond ordinary identity theft.
What happened
A group calling itself the Department of Peace claimed responsibility for the breach. It passed the data to Distributed Denial of Secrets (DDoSecrets), a transparency collective, which published it in a searchable database called “Icepick” on October 28, 2026. A hacktivist known as “maia arson crimew” built the search tool, Reuters reported.
NPR reported that more than 21,000 of the records identify Customs and Border Protection employees, and about 10,000 relate to Immigration and Customs Enforcement and its Homeland Security Investigations unit. That is roughly a fifth of a DHS workforce of a little over 220,000, NPR said. Reuters said the data also covers CISA and other DHS components.
The two outlets differ on some details. Both report names and phone numbers; NPR also lists addresses, while Reuters lists email addresses, job titles and email groups that point to assignments in special operations, surveillance, computer forensics and undercover work. Reuters matched six named employees to credit-bureau and breach records and confirmed three by phone.
How the data was obtained
The hackers said they took the data by subverting DHS’s single sign-on system, NPR reported. DDoSecrets co-founder Emma Best told Reuters the group harvested it from the Okta sign-on service DHS uses, but Reuters could not corroborate that. Okta said it has no evidence its data or systems were compromised. The method is therefore unconfirmed.
Who is affected and why it matters
Federal employees whose details appear in the database face doxxing, harassment, phishing and social-engineering attempts. For people in undercover or surveillance roles, exposure of identities and contact details can carry real-world safety consequences. The leak also gives hostile actors a ready-made target list for impersonation of colleagues or contractors.
DHS told NPR it is aware of a potential breach and is working to address it. Reuters said DHS had not responded when its story published.
What to do
The steps below are our analysis, not guidance from DHS or the reporters.
- DHS and contractor staff: assume your name and work contact details are public. Treat unexpected calls, texts and emails that mention your role as suspect, and verify through an internal directory.
- Security teams: rotate sign-on and session tokens, review identity-provider logs for unusual token use, and enforce phishing-resistant multifactor authentication.
- Everyone: be wary of messages that cite leaked names or job titles, and report suspicious contact to your security office.
- Journalists and researchers: weigh the safety risk to individuals before handling or republishing the data.
What we still do not know
- Exactly how the attackers got in, and whether Okta or a DHS configuration was involved.
- Whether the data is complete, current or contains errors.
- Whether further releases are planned.
- What DHS will do for employees in sensitive roles.
Sources: NPR via WYPR, Oct. 28, 2026 (corrected Oct. 29); Reuters via GV Wire, Oct. 28, 2026.
Leave a Reply