# "Icepick" leak exposes records on 41,000 DHS employees, including undercover ICE agents · pwn.watch > Distributed Denial of Secrets published "Icepick" on Oct 28 2026, an archive covering more than 41,000 employees and contractors of the US Department of Homeland Security and seven component agencies, including ICE and CBP. The records, last updated Aug 19 2026, include work email addresses, cellphone numbers, office addresses, supervisors and more than 55,000 permission-group names, some referencing undercover operations, wiretap programs and tools such as Palantir and PenLink. DDoSecrets says the data came from DHS's Okta login system via a group calling itself the Department of Peace; Okta says it has no evidence its own systems were compromised. Page: https://pwn.watch/i/dhs-icepick-okta-leak-41k-employees-oct-2026 · generated 2026-10-29T00:56:39.940Z ## Status - Severity: high · status: live · patch: no-fix-needed - Product: US Department of Homeland Security (Okta identity directory) - Started: 2026-10-28 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/dhs-icepick-okta-leak-41k-employees-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/dhs-icepick-okta-leak-41k-employees-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/dhs-icepick-okta-leak-41k-employees-oct-2026.json - This file: https://pwn.watch/i/dhs-icepick-okta-leak-41k-employees-oct-2026/llms.txt ## Updates (newest first) - 2026-10-28: Distributed Denial of Secrets publishes "Icepick", records on more than 41,000 DHS employees and contractors (email addresses, phone numbers, office addresses, supervisors and over 55,000 permission-group names, including groups tied to undercover operations and wiretap programs). DDoSecrets says the data came from DHS's Okta login system and was obtained from a group calling itself the Department of Peace. (https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/) - 2026-10-28: Okta tells WIRED it is unaware of any breach of its systems and has no evidence its data or systems were compromised. DHS and DOJ did not respond to WIRED's request for comment. (https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/) - 2026-08-19: Last update date of the leaked DHS records, which cover DHS itself and seven component agencies including ICE and CBP. (https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/) ## Fix brief # Security brief: "Icepick" leak exposes records on 41,000 DHS employees, including undercover ICE agents Source: https://pwn.watch/i/dhs-icepick-okta-leak-41k-employees-oct-2026 · status: live · severity: high · updated Oct 28, 2026, 22:03 UTC ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is Distributed Denial of Secrets published "Icepick" on Oct 28 2026, an archive covering more than 41,000 employees and contractors of the US Department of Homeland Security and seven component agencies, including ICE and CBP. The records, last updated Aug 19 2026, include work email addresses, cellphone numbers, office addresses, supervisors and more than 55,000 permission-group names, some referencing undercover operations, wiretap programs and tools such as Palantir and PenLink. DDoSecrets says the data came from DHS's Okta login system via a group calling itself the Department of Peace; Okta says it has no evidence its own systems were compromised. Severity detail: Identity and contact records for about a seventh of the DHS workforce, including undercover and surveillance-program group memberships; no passwords or financial data reported - Product: US Department of Homeland Security (Okta identity directory) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Nothing to patch for readers. If your organisation uses Okta or another SSO directory, this is a reminder that directory data (users, phone numbers, group memberships and group names) is sensitive in itself: review who and which apps can read the directory and audit recent bulk directory exports. DHS staff should expect targeted phishing and impersonation using the leaked contact and org-chart details. ## Latest updates - Oct 28, 2026: Distributed Denial of Secrets publishes "Icepick", records on more than 41,000 DHS employees and contractors (email addresses, phone numbers, office addresses, supervisors and over 55,000 permission-group names, including groups tied to undercover operations and wiretap programs). DDoSecrets says the data came from DHS's Okta login system and was obtained from a group calling itself the Department of Peace. - Oct 28, 2026: Okta tells WIRED it is unaware of any breach of its systems and has no evidence its data or systems were compromised. DHS and DOJ did not respond to WIRED's request for comment. - Aug 19, 2026: Last update date of the leaked DHS records, which cover DHS itself and seven component agencies including ICE and CBP. ## Write-ups & news - [Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents](https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/) - [Latest Drop by DDoS Contains Contact Info for 40k DHS Employees](https://www.techdirt.com/2026/10/28/latest-drop-by-distributed-denial-of-secrets-ddos-contains-contact-info-for-40000-dhs-employees/) - [Leak Exposes 41,000 Homeland Security Workers–Including Undercover ICE Agents](https://news.ycombinator.com/item?id=50280864) ## Caveats How the Department of Peace group got the data has not been confirmed: DDoSecrets says it came from DHS's Okta login system, while Okta says it is unaware of any breach of its systems. DHS has not commented. Per WIRED, CBP staff make up more than half of the records, ICE about 10,000, USCIS about 6,200 and CISA nearly 1,000. --- Machine-readable: https://pwn.watch/i/dhs-icepick-okta-leak-41k-employees-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.