If you saw headlines this week about a DHS data leak exposing tens of thousands of federal workers, you probably have one practical question: how much of it is real? The short answer is that the DHS data leak is real and parts of the data have been independently checked, but how the records were obtained, how current they are, and how much harm they could cause are still open questions.
On Wednesday, Oct. 28, 2026, the transparency nonprofit Distributed Denial of Secrets (DDoSecrets) published a searchable dataset it calls "Icepick," covering more than 41,000 Department of Homeland Security employees and contractors, according to CyberScoop. Here is what is established about the DHS data leak, what is only claimed, and what to watch for next.
The short version
- Confirmed: The dataset was published on Oct. 28, and news organizations have matched some names and phone numbers to real DHS employees.
- Confirmed: DHS has acknowledged it is aware of a potential breach. It has not confirmed how one happened.
- Claimed, disputed: The hackers say they took the data through an Okta single sign-on service used by DHS. Okta says it has no evidence its systems were compromised.
- Unclear: When the data in the DHS data leak was taken, how accurate and complete it is, and whether any active operations or undercover identities are actually at risk.
What happened
A hacktivist group calling itself the "Department of Peace" passed the records to DDoSecrets and to maia arson crimew, a Swiss hacker and journalist, CyberScoop reported. DDoSecrets then posted the dataset online, and crimew built a search tool on top of it.
The group tied the DHS data leak to DHS Secretary Markwayne Mullin's July 17 remark that ICE would be "turning up the heat" on immigration enforcement, as CNBC noted. That is the group's stated motive, not an established fact about who is behind it.
Daily US Wire is not linking to the leaked database or its search tool. The records name individual federal workers, many of whom are not public figures, and the reporting below can be understood without it.
What Is Confirmed About the DHS Data Leak
The data exists and is partly authentic
Reuters matched personal information for six DHS employees named in the leak against credit bureau records and breach data, and it confirmed phone numbers by calling three of them, Help Net Security reported. One of those employees said it was the first they had heard of a breach.
CyberScoop separately verified that numerous current employees of the Cybersecurity and Infrastructure Security Agency (CISA) appear in the data, along with former leaders who left years ago.
Six matches and a set of CISA names do not verify 41,000 records. They do show the DHS data leak is not a fabrication.
What kind of information is in it
Reporting so far describes the DHS data leak as work-related directory data rather than case files: names, phone numbers, email addresses, job titles, offices, and internal group memberships. CNBC, which accessed the database, said it also appeared to show employees' managers.
According to figures published by the search tool's operators, as summarized by Help Net Security, the index lists 41,191 people and 55,603 internal groups. Customs and Border Protection accounts for the largest share, with about 21,300 entries, followed by ICE with about 6,600. Those are the publishers' own counts, not government figures.
The internal group names are the more sensitive part. Some appear to reference undercover agent certifications, use-of-force instruction, and access to forensic and data-analysis tools.
DHS's response
In a statement shared with the BBC, a DHS spokesperson said the department is "aware of a potential breach" and is working to address it, adding that it takes threats against employees seriously and will share more information when available. As of Oct. 29, DHS had not publicly said how the data was obtained or how many people it has notified.
What is claimed but not proven
The Okta connection
Single sign-on (SSO) is the system that lets employees log in once and reach many internal apps. Because an SSO directory knows who works where and which tools they can use, it is a plausible place to find this kind of data.
The hackers say that is where the DHS data leak came from. Okta told Reuters, "Okta is secure, and we have no evidence our data or systems were compromised."
Those two statements are not necessarily in conflict. A company's own systems can remain secure while one customer's account, configuration, or credentials are misused. But no public reporting has shown how, or when, the data was actually taken, so any explanation is speculation for now.
What the data reveals
DDoSecrets co-founder Emma Best has described Icepick as a map of the people who design and run DHS policy, including officials tied to covert operations and deportation programs. That is the publisher's characterization. Seeing a person's name in a group called "undercover" is not the same as proving their cover has been blown.
What remains unclear
- How old the data is. CyberScoop found group names referring to COVID-19 planning and internal summits in 2023, so at least some of it is years old. People may have changed jobs or left.
- How accurate it is. The search tool's operators say the list does not include every DHS employee and may reproduce errors from the source data. They also say they "enriched" records through outside research, which blurs the line between what was leaked and what was added.
- Whether more sensitive data exists. The reporting reviewed for this article describes contact and role data, not Social Security numbers or financial records. That could change if more material surfaces.
- Real-world harm. It is not yet known whether any investigation or operation has been compromised.
- Government follow-up. There is no public word yet on a criminal investigation, an inspector general review, or congressional hearings tied to the DHS data leak.
Confirmed vs. claimed at a glance
|
Claim |
Status as of Oct. 29 |
Basis |
|---|---|---|
|
Dataset published Oct. 28 by DDoSecrets |
Confirmed |
Multiple outlets |
|
Some records belong to real DHS employees |
Confirmed (partial) |
Reuters, CyberScoop checks |
|
More than 41,000 people listed |
Reported |
Publishers' own count |
|
DHS aware of a potential breach |
Confirmed |
DHS statement to BBC |
|
Data taken via Okta SSO |
Claimed, disputed |
Hackers' claim; Okta denial |
|
Undercover operations compromised |
Unproven |
No public evidence |
|
SSNs or financial data included |
Not reported |
No outlet cited here has found any |
How this fits a larger pattern
Help Net Security counts the DHS data leak as the third major blow to federal agencies in roughly a month. In late September, the ShinyHunters extortion group claimed it stole FBI employee and applicant data from the bureau's job portals. Days later, the Pentagon's Defense Manpower Data Center began notifying more than 3 million people that their personal data, including Social Security numbers, had been accessed.
DHS itself has a history here. The same "Department of Peace" name was attached to a March 2026 leak of records on 6,681 organizations that had sought DHS business, TechRepublic reported. Older incidents include a 2014 breach that may have affected about 390,000 people and a 2018 notice to nearly 250,000 current and former employees, according to CyberScoop.
Why a "directory" leak still matters
It is tempting to dismiss the DHS data leak as just names and work emails. The risk is less about identity theft and more about targeting:
- Phishing and impersonation. Real names, titles, and team names make fake emails far more convincing.
- Harassment. Federal workers in ordinary roles can be swept up alongside senior officials.
- Mapping. Group memberships can hint at who has access to which systems, which is useful to foreign intelligence services as well as activists.
Supporters of the release argue the opposite side: transparency researchers say accurate names and contact details make public-records requests far more effective. Both arguments can be true at once, which is part of why this leak is drawing sharp reactions.
Practical steps right now
If you or a family member works for DHS or as a DHS contractor:
- Treat unexpected calls, texts, and emails referencing your job with extra suspicion, even if they use your correct title or team name.
- Verify requests through a known internal channel, not the contact details in the message.
- Follow your agency's security office guidance and report suspicious contact.
- Review what your public social media profiles reveal about your role, location, and family.
If you are a general reader:
- Based on what has been reported, you are not exposed in the DHS data leak unless you work for DHS or one of its contractors.
- Avoid sharing screenshots or names from the leak. Information can be wrong, and spreading it can harm people who were misidentified.
If you run IT for an organization that uses SSO: this is a reminder to review administrator accounts, enforce phishing-resistant multifactor authentication, and limit who can export directory data. For another recent example of why patching and access control matter, see our coverage of the PHP2Shell vulnerabilities.
What would change the picture
Watch for these developments in the coming days:
- A DHS statement confirming, or ruling out, a breach and its source
- Any Okta or third-party forensic finding about the access path
- Formal notifications to affected employees
- Evidence that sensitive personal data, such as home addresses or SSNs, was included
- Action from the Justice Department, the DHS inspector general, or Congress
Until then, the most accurate way to describe the DHS data leak is simple: a large, partly verified employee directory is now public, the government acknowledges a potential breach, and the most important questions about how it happened remain unanswered. We will update this article as official information becomes available.
