ABAB News Logo
Back to Flash News

DDoSecrets releases Icepick dataset containing over 40,000 U.S. Department of Homeland Security personnel records

On October 28, 2026, Distributed Denial of Secrets (DDoSecrets) publicly released a dataset called “Icepick,” containing over 40,000 records of U.S. Department of Homeland Security (DHS) employees and contractors. A hacker calling itself Department of Peace claimed the data came from the Okta single sign-on system used by DHS, which employees and contractors use to log into the central network and which is tied to internal system and application permission information. The records include names, job titles, work email addresses, phone numbers, and office locations.

According to TechCrunch, about 21,000 records in the dataset correspond to Customs and Border Protection (CBP) personnel, about 10,000 involve Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) unit, and nearly 1,000 are related to the Cybersecurity and Infrastructure Security Agency (CISA). Several thousand more involve DHS headquarters and other agencies. Timestamps in the records show that the data was exported around mid-August; WIRED said the dataset was last updated on August 19, 2026. TechCrunch verified some of the data’s authenticity by matching known DHS employee names. DDoSecrets said the records total more than 41,000.

The hacker provided the data to journalist and hacker maia arson crimew, who then passed it on to DDoSecrets. A note accompanying it said that they have our information, so it is only fair that we have theirs too. A Department of Peace spokesperson said the move was in response to DHS Secretary Markwayne Mullin’s earlier comments about “turning up the heat.” An Okta spokesperson said that Okta is secure and that there is no evidence its own data or systems were compromised. A DHS spokesperson had not responded to a request for comment.

Original sources:

  1. Title: Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents Publisher: TechCrunch / Zack Whittaker Publication date: 2026-10-28 URL：https://techcrunch.com/2026/10/28/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-agents/ Source type: media report Verification status: full text read for this item; verification date 2026-10-28 Supporting content: scale of over 40,000 records, about 21,000 CBP, 10,000 ICE/HSI, nearly 1,000 CISA; claim of Okta SSO source; export timestamp around mid-August; partial verification by TechCrunch; provided to maia arson crimew and then transferred to DDoSecrets; Okta response and DHS declined to comment; about one-fifth of roughly 220,000 employees.

  2. Title: Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents Publisher: WIRED Publication date: 2026-10-28 URL：https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/ Source type: media report Verification status: full text read for this item; verification date 2026-10-28 Supporting content: over 41,000 records; last updated 2026-08-19; CBP accounts for more than half, ICE about 10,000 records (about one-third HSI), CISA nearly 1,000; Okta denial; data preview provided to WIRED.

  3. Title: Icepick Publisher: Distributed Denial of Secrets Publication date: 2026-10-28 URL：https://ddosecrets.org/article/icepick Source type: official announcement / original post by the party involved (dataset release page) Verification status: full page read for this item; verification date 2026-10-28 Supporting content: dataset name Icepick, over 41,000 records, claimed to come from Okta SSO, provided to DDoSecrets and maia arson crimew by Department of Peace; accompanying note and spokesperson statement.

  4. Title: Hacktivists claim to have hacked Homeland Security to release ICE contract data Publisher: TechCrunch / Lorenzo Franceschi-Bicchierai Publication date: 2026-03-02 URL：https://techcrunch.com/2026/03/02/hacktivists-claim-to-have-hacked-homeland-security-to-release-ice-contract-data/ Source type: media report Verification status: full text read for this item; verification date 2026-10-28 Supporting content: Department of Peace in March 2026 claimed to have breached DHS and released contract data (does not prove this Okta incident).

ABAB AI Insight

Department of Peace previously published DHS and ICE contract data through DDoSecrets in March 2026, involving more than 6,000 companies, including Anduril, Palantir, Microsoft, and Oracle, and cited the shooting deaths of Minneapolis protesters Alex Pretti and Renée Good by federal agents as motivation. This Icepick release instead focuses on personnel directories and permission groups, and maia arson crimew created a searchable tool for it. DDoSecrets co-founder Emma Best said the data helps identify people responsible for covert operations, leak investigations, and work related to BlueLeaks. BlueLeaks is about 269GB of internal U.S. law enforcement fusion center data obtained by Anonymous in 2020 and published by DDoSecrets.

Okta, as an identity and access management provider, supplies SSO to DHS. The company responded that its own systems were not compromised and that the data may have been obtained through customer-side credentials or configurations. Okta has experienced multiple supply-chain or support-system incidents in the past, such as the 2023 support-system leak affecting metadata for all customers. The records include Active Directory permission groups covering the Penlink surveillance tool, the Mobile Fortify facial recognition app, Headspace mental health services, and ChatGPT access, showing the connection between law enforcement operations and third-party technology tools.

Compared with BlueLeaks in 2020, Icepick is smaller in scale but more focused on the identities and permissions of current law enforcement personnel rather than historical intelligence reports. BlueLeaks mainly came from the fusion center outsourcing developer Netsential, while the claimed path here is the Okta SSO used by DHS. Both were hosted by DDoSecrets and investigated by law enforcement agencies. The difference is that Icepick directly concerns CBP and ICE personnel at the current height of immigration enforcement, and it occurred after DHS Secretary Markwayne Mullin took office (sworn in in March 2026).

This release makes public the work contact details and permission groups of some DHS law enforcement personnel, changing the anonymized operating environment that law enforcement agencies have long relied on. For CBP and ICE, FOIA requests and journalist investigations can directly identify specific personnel and supervisory chains; for Okta and DHS, customer-side access control and log monitoring become key points of observation. If permission-group information is linked with commercial data or historical leaks, it could expand the social-engineering attack surface, but the core issue still depends on whether DHS has confirmed and patched the export path.

ABAB News · Cognitive Law

  1. Law enforcement anonymity depends on system boundaries; once the boundary is penetrated by customer-side credentials, the directory becomes a public ledger.

  2. The same hacker group has shifted from contract data to personnel permissions, with the path moving from external procurement to the internal identity layer.

  3. Okta denying that its own systems were compromised does not mean that the customer directory was not exported.