Hacktivists claim DHS personnel records on 41,000 staff. What is confirmed, and what is only claimed

In brief

Developing. Last updated 29 October 2026, 09:10 Dubai time (UTC+4).

A hacktivist group calling itself Department of Peace claims it obtained records on more than 41,000 Department of Homeland Security (DHS) employees and contractors, according to WIRED and CNBC. The nonprofit Distributed Denial of Secrets published the data on 28 October and calls it "Icepick", WIRED reports.

DHS told TechCrunch and WIRED it "is aware of a potential breach and is actively working to address the situation swiftly and effectively." Okta told both outlets: "Okta is secure, and we have no evidence our data or systems were compromised."

What is claimed, and by whom

• The route. TechCrunch reports the group claimed it obtained the data from an Okta single sign-on system DHS uses for employees and contractors. WIRED reports that a Distributed Denial of Secrets press release says the data is from DHS's Okta login system. No outlet cited here has confirmed that route.
• The scale. TechCrunch counts some 21,000 records relating to US Customs and Border Protection (CBP), about 10,000 relating to Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) unit, and just under 1,000 at the Cybersecurity and Infrastructure Security Agency (CISA). WIRED's own analysis gives similar figures: CBP more than half, ICE about 10,000 and CISA nearly 1,000.
• The contents. TechCrunch says the records include names, job titles and work contact details such as email addresses, cell phone numbers and office locations. WIRED says the records were last updated on 19 August 2026.

How far it has been verified

TechCrunch says it verified a portion of the data by matching the names of several known DHS employees.

ByteNib has not accessed the data, and this article does not name or link to any individual or to the dataset.

What it means for security teams

This section is ByteNib analysis.

• Treat SSO as a directory, not just a door. If the group's claim is accurate, one identity platform exposed who works where, who reports to whom and which apps each person can open. Review what attributes your identity provider holds and who can query them in bulk.
• Expect targeted phishing. Named staff with phone numbers, titles and managers make convincing pretexting easy. Brief exposed teams, and tighten help-desk identity checks for password and MFA resets.
• Watch the vendor statements. Okta says it has no evidence of compromise. Until DHS explains how the data left, the cause, whether on the DHS side or the platform side, remains unconfirmed.

Sources and scope

• TechCrunch, "Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents", 28 October 2026: the group's Okta claim, agency record counts, data types, TechCrunch's partial verification, and DHS and Okta statements.
• WIRED, "Massive Leak Exposes 41,000 Homeland Security Workers", 28 October 2026: the 41,000 figure, "Icepick", publication date, DDoSecrets' Okta statement, record update date, WIRED's agency analysis, and DHS and Okta statements.
• CNBC, "Over 41,000 U.S. Homeland Security officials' details apparently exposed after massive data breach", 29 October 2026: the group's name and the 41,000 figure.

All breach details are claims by the group or reports by the outlets named; ByteNib has not independently verified them. Security guidance is ByteNib editorial analysis. This article was researched and drafted with AI assistance and edited under ByteNib's editorial standards.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.