Hacker Leaks Records of Over 41,000 DHS Employees, Claims Okta SSO Theft

A threat actor using the handle "Department of Peace" has leaked a database containing the personal and work information of more than 41,000 US Department of Homeland Security employees, SecurityWeek reported on October 29, 2026.

The hacker claims the data was stolen from an Okta single sign-on system that DHS employees and contractors use to reach its central environment. In a note, the actor wrote: "They have our information, so it's only fair that we have theirs."

Okta disputed that account. "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised," a spokesperson told SecurityWeek. DHS had not responded to a request for comment at the time of publication.

What's in the data

Most of the leaked records reportedly cover Customs and Border Protection, Immigration and Customs Enforcement and Homeland Security Investigations employees. Roughly 1,000 CISA employees and personnel from other DHS agencies are also included. The data holds names, work emails and phone numbers, job titles and office locations, plus records showing which systems and internal applications each account can reach. A search tool for the data is also online.

Distributed Denial of Secrets, which obtained a copy and calls it "Icepick," says it identifies officials overseeing covert and undercover operations and key staff in DHS rendition and deportation programs.

Why the access map matters

Gary Barlet, public sector CTO at Illumio, told SecurityWeek the access details are the bigger problem: knowing which employees reach which systems gives an attacker a roadmap of where to go and who to target.

The leak surfaced a month after the ShinyHunters extortion group breached FBI systems, and three months after the Homeland Security Information Network was hacked, according to the report.

For defenders

The exposure is a reminder that identity metadata, not just credentials, is sensitive. Organizations should limit who can enumerate application assignments, review logs for unusual directory queries, and treat leaked org charts and access lists as reconnaissance that can feed targeted phishing.