Hacker posts 41,000+ DHS employee records. Okta disputes link

A hacker just posted a searchable trove of more than 41,000 US Department of Homeland Security (DHS) employee records. It lists names, work emails, job titles, phone numbers, and offices—and, critically, which internal systems each person can access, SecurityWeek reports.

The actor, using the handle “Department of Peace,” claims the data came from an Okta single sign-on (SSO) system used by DHS employees and contractors to reach a central environment. Okta told SecurityWeek, “Okta is secure, and we have no evidence our data or systems were compromised.”

What happened

SecurityWeek says the leaked dataset includes records tied mostly to US Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), and Homeland Security Investigations (HSI), with roughly 1,000 Cybersecurity and Infrastructure Security Agency (CISA) employees also listed.

The posted fields go beyond contact details, exposing job roles and granular records of which internal applications and systems each account can access, a sensitive map that can guide targeted intrusion attempts.

An online search tool has been stood up to query the leak, effectively turning an internal directory into a public lookup that attackers can mine for spearphishing and social engineering targets by role and office.

Distributed Denial of Secrets says it obtained a copy and has labeled the dataset “Icepick,” asserting that it identifies officials tied to covert and undercover operations, as well as personnel in rendition and deportation programs.

Illumio public sector CTO Gary Barlet warned that paired contact and access info can function like a breach roadmap, saying, “If an attacker knows which employees have access to which systems and applications, they’ve essentially been handed a roadmap for where to go next and who to target to get there.”

DHS told SecurityWeek it’s aware of a potential breach and is working to address it “swiftly and effectively,” adding that it takes threats against employees and officers seriously and will update the public as more information becomes available.

The hacker framed the leak as payback for government data collection, writing, “They have our information, so it’s only fair that we have theirs,” positioning the dump as a retaliatory disclosure rather than a ransom ploy.

The claimed source is an Okta SSO instance, according to the hacker’s note, but Okta’s statement to SecurityWeek rejects that link, leaving the exact path of compromise unresolved pending further investigation.

The background

The incident surfaced a month after the ShinyHunters extortion group breached FBI systems and three months after the Homeland Security Information Network (HSIN) was hacked, per SecurityWeek’s timeline context.

Because the leak lists work email addresses and phones alongside roles, it lowers the effort needed to craft convincing lures aimed at staff with access to high‑value systems, a classic prelude to credential theft or session hijacking.

Attackers increasingly skip passwords and go after tokens and trusted flows; our coverage of device‑code phishing against U.S. orgs shows how adversaries piggyback on legitimate sign‑ins to reach cloud accounts without re‑prompting for MFA.

Token replay campaigns have also scaled quickly; Huntress tracked Microsoft 365 token replay across dozens of tenants, illustrating how one weak link can be multiplied once the right target is identified.

Criminals are also upping the realism of phishing pages; as we reported, AI‑made login clones can capture multi‑factor prompts and active sessions, making any high‑fidelity directory a springboard for more precise—and successful—impersonation.

For the email world, high‑profile government leaks often ripple into stricter filtering and nervous recipients; we’ve outlined how to keep deliverability stable when security headlines spike so legitimate mail doesn’t get caught in the dragnet.

If the dataset’s access mappings are accurate, they can expose which teams to impersonate for internal approvals, which applications to spoof in alerts, and which help‑desk workflows to test—consequences that extend well beyond inboxes into identity and support processes.

What people are saying

DHS said it’s addressing the situation and will protect impacted employees and officers, signaling operational steps are underway while details of the intrusion vector remain undisclosed.

Okta’s spokesperson told SecurityWeek that the company is secure and found no evidence of a compromise, a position that directly contradicts the hacker’s claim of an Okta SSO origin.

Distributed Denial of Secrets characterizes the “Icepick” trove as identifying personnel involved in sensitive operations, raising concerns about targeted harassment or coercion alongside cyber risks.

Illumio’s Gary Barlet emphasized that the access metadata heightens danger by pinpointing who to phish first and which internal systems to chase, sharpening the likely focus for attackers.

The hacker’s justification—“They have our information, so it’s only fair that we have theirs”—frames the leak as retaliatory exposure, which can complicate attribution and intent assessment for defenders.

What happens next

DHS says it will update the public as the investigation progresses, but for now, the presence of a live search tool means affected addresses and roles are already in circulation.

Organizations that interact with DHS staff should expect a rise in tailored phishing attempts, spoofed internal alerts, and help‑desk social engineering shaped by leaked role and access details.

Security teams can preempt some fallout by tightening MFA prompts, watching for suspicious consent grants, and alerting on new inbox rules—controls that blunt social‑engineering‑led account takeovers.

Senders should also brace for more cautious filtering downstream; keeping SPF, DKIM, and DMARC clean and consistent can help legitimate outreach avoid false positives as security postures harden across the security landscape.