Over 41,000 DHS employee records leaked online, including access details

A threat actor using the handle "Department of Peace" has published data on more than 41,000 U.S. Department of Homeland Security (DHS) employees, according to SecurityWeek and Help Net Security on October 29, 2026. The dataset includes not just contact details but also records of which internal systems and applications each account can access, a point security experts quoted in the reporting called the most concerning element.

What happened

SecurityWeek reported that the leaked information covers more than 41,000 DHS staff and includes names, work email addresses, phone numbers, job titles, office locations, and records showing which systems and internal applications each account is authorized to use. An online search tool for the data was also made available. The outlet quoted the hacker as writing, "They have our information, so it's only fair that we have theirs." The transparency group Distributed Denial of Secrets obtained a copy of the database and refers to it as "Icepick," according to SecurityWeek.

Who is affected

Most of the records reportedly belong to staff at U.S. Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), and Homeland Security Investigations (HSI), SecurityWeek said. Roughly 1,000 CISA employees and personnel from several other DHS agencies were also affected. According to SecurityWeek, the leaked information identifies officials in charge of covert and undercover operations as well as key personnel in DHS's rendition and deportation programs. Help Net Security framed the incident as hacktivists exposing undercover agents, underscoring the potential physical-safety dimension of the exposure.

How it was obtained

The hacker claimed the data was stolen from an Okta single sign-on system that DHS employees and contractors use to reach the department's central environment, SecurityWeek reported, adding that it could not independently confirm this. Okta told SecurityWeek: "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised." The outlet said the data was taken "earlier this year," without an exact date, and that it emailed DHS for comment but did not report a response. SecurityWeek did not tie the leak to a known group; it mentioned the ShinyHunters extortion crew only as context, noting that group breached FBI systems a month earlier, and separately that the Homeland Security Information Network (HSIN) was hacked three months earlier.

What to do

For organizations watching this case, the lesson highlighted in the reporting is that the exposure of access and entitlement data can be as damaging as the exposure of personal details, because it maps out which accounts reach which systems. Illumio public sector CTO Gary Barlet told SecurityWeek, "The most concerning part of this breach is the access information that came with it." Defenders are advised to treat identity providers such as single sign-on platforms as high-value targets, enforce phishing-resistant multi-factor authentication, monitor for anomalous access, and limit how much entitlement detail any single account or export can expose. Because key attribution and root-cause questions remain open, the specifics here should be read as claims under investigation rather than confirmed facts.