Icepick DHS leak: what 41,000 directory records show and what to check in your own SSO

What is the Icepick DHS leak?

Icepick is the name Distributed Denial of Secrets (DDoSecrets) gave to a dataset it published on 28 October 2026: "an internal database identifying more than 41,000 employees" of the U.S. Department of Homeland Security (DHS). It says the data comes "from an Okta single sign-on service used by the DHS" and that it was obtained by a hacktivist group called the Department of Peace.

The records list names, job titles, work email addresses, phone numbers and offices, and for most people a supervisor. They also list membership in internal permission groups, the groups that decide which systems and apps an account may open. TechCrunch describes the Okta system as holding "details about which systems and internal apps they are permitted to access". WIRED sums the dataset up as "a map of how DHS is organized and how it operates".

The leak is political, and the people behind it say so. The Department of Peace tied the release to a July remark by DHS Secretary Markwayne Mullin, and DDoSecrets presents it as a tool for journalism and Freedom of Information Act (FOIA) requests. DHS says it takes threats against its staff seriously. This article takes no side on that. It looks at what the data is, what is confirmed, and what any organization that runs a single sign-on directory should take from it. We do not link to the data or to the search sites built on it.

Short on time? Go straight to the checklist for your own directory.

The Icepick DHS leak at a glance

Timeline of the Icepick DHS leak

Times are UTC and come from the source named in each entry.

• 1 March 2026. The same group, Department of Peace, releases DHS contract data on more than 6,000 companies, which it says came from the DHS Office of Industry Partnership (TechCrunch).
• Mid-August 2026. The timestamps on the directory records point to an export around this time (TechCrunch). WIRED reports the records were last updated on 19 August.
• 28 October. DDoSecrets publishes Icepick. WIRED and TechCrunch publish their analyses around 20:00, within minutes of each other. DHS and Okta give the statements quoted above.
• 28 October, by late evening US time. Bluesky blocks links to the archive, citing contact details "shared without their authorization" (WIRED).
• 29 October, morning. The first searchable site built on the data is offline; DDoSecrets says its registrar took the domain down and publishes the search tool's source code (CyberScoop, DDoSecrets).
• 29 October. Reuters matches details of six named employees to credit bureau and breach records and confirms them by phone with three; one says it is the first they have heard of a breach (Help Net Security).

What the directory gives away beyond names

A staff list is not new. Names and work email addresses of many public employees can be found already, and a civil liberties lawyer told WIRED the basic fields are information "that would be on a business card". What makes Icepick different is the rest of the record.

• Reporting lines. Most records name a supervisor, so the org chart can be rebuilt from senior leadership down to individual agents (WIRED). An org chart is what a convincing fake request from a manager needs.
• Phone numbers. Work mobile numbers turn a name into something that can be called or texted. That is the raw material for vishing, smishing and SIM swap attempts; our guide to SIM swap attacks on executives covers the carrier locks that stop them.
• Permission groups as an app map. Most people in the dataset belong to the Microsoft 365 group, and many to groups for Citrix, Adobe and other desktop software (TechCrunch). Others reference investigative platforms, phone analysis tools and AI chat services. An attacker no longer has to guess which login page to fake.
• Group names as program names. WIRED found 39 HSI employees in groups whose names include "CUC", which court filings say stands for certified undercover operation, plus groups that reference wiretap and intercept programs. Group names were written for internal use, so they often describe projects in plain words.
• Exception groups. Two groups, "Executive Leadership" and "AI Access", contain the same 13 people and appear to list exceptions to the department's web filter (WIRED). Exception groups show where a control does not apply, so they deserve the tightest review.

Alexander Leslie of Recorded Future put the risk this way to WIRED: the data "becomes way more valuable when correlated with previously compromised information, commercial data, and other intelligence collections", and an adversary could use it to "identify vulnerable personnel, develop convincing impersonation attempts, or compromise ongoing investigations".

That correlation has already been shown. Reuters took six names from the leak and found them in credit bureau and breach data. The directory supplies who and what; breach and leak data supplies the personal email, the old password and the home address. For people in sensitive roles, that can lead to doxxing and swatting.

Icepick myths: was Okta hacked, and were home addresses leaked?

The leak spread fast on X, and several claims travel with it that the reporting does not support.

• "Okta was hacked." The Department of Peace says the data came from the Okta single sign-on service DHS uses. Okta says it has no evidence its systems or data were compromised. Those two statements do not contradict each other: a stolen admin session, an over-permissioned API token or a misused integration in one customer's Okta organization would expose that customer's directory without any breach of Okta. How the data was taken is not public, and TechCrunch notes it is unclear whether the hole has been closed.
• "Home addresses of 40,000 agents." The fields TechCrunch, WIRED and the BBC list are work contacts and office locations. Home addresses come from joining the directory with other data, as Reuters did with credit bureau records. That join is the real risk, but it is not what the file contains.
• "Every DHS employee." The dataset covers about 41,000 people. TechCrunch and NPR put that at about a fifth of a workforce of around 220,000; WIRED calls it about a seventh.
• "A live list of current staff." The export is from mid-August, and CyberScoop and Nextgov/FCW found people who left CISA years ago. Some records are out of date, and the search tool's operators warn that errors in the source carry over.
• "A list of undercover agents." What the data shows is membership in groups whose names reference undercover operations, 39 people in the "CUC" groups WIRED counted. That is serious, but it is not a roster of every undercover officer.

Icepick DHS leak: what to check in your own SSO directory

The Icepick DHS leak is about one government department, but the weakness is generic. Every company on Okta, Microsoft Entra ID or Google Workspace keeps the same kind of directory, and in most of them far more people and integrations can read it than anyone has counted. This list uses Okta's own guidance where it exists; the same steps apply to other identity providers.

1. Treat the directory as sensitive data. Classify the full user and group export like customer data, not like a phone list. Decide who needs to read all of it, and write that down.
2. Inventory what can read it. List the admin accounts, API tokens and integrations with read access to all users and groups. Okta's developer documentation says "API tokens inherit the privilege level of the admin account that is used to create them", recommends a dedicated service account for creating them, and "strongly recommends" scoped OAuth 2.0 tokens instead. A token made by a super admin for a small sync job can read everything.
3. Revoke what you cannot explain. Remove tokens and integrations nobody owns. Okta tokens unused for 30 days expire, so a token that still works was either created recently or is still in use by something; find out what.
4. Protect the admins and the help desk. In 2023 Okta described callers who talked IT service desks into resetting MFA on super admin accounts. Its advice: phishing-resistant authentication such as FIDO2 for admins, re-authentication for sensitive admin actions, help desk roles that cannot touch admin groups, and stronger caller verification. It also recommends admin policies that require managed devices and trusted network zones and bind admin sessions to the IP and network they started from, so a stolen session cannot be replayed elsewhere. A leaked directory with mobile numbers and reporting lines makes those calls easier to script. CISA's fact sheet on phishing-resistant MFA covers the options.
5. Hunt for the moves that follow. Okta's advisory lists the System Log events to watch, among them user.mfa.factor.reset_all for factor resets and the system.idp.lifecycle events for new or changed identity providers. Add alerts for large exports of users or groups by a token or app that does not usually make them.
6. Rename groups that tell a story. Group names show up in exports, logs and support tickets. A name such as "Project X undercover" or "M&A deal team" tells a reader who works on what. Use neutral identifiers for sensitive groups and keep the meaning in a separate, access-controlled register.
7. Look at the exception groups. Groups that exempt people from web filtering, device rules or MFA are the first ones an attacker reads. Keep them small, review them every quarter and make sure their members have the strongest controls, not the weakest.
8. Plan for the directory leaking anyway. If your staff list became public tomorrow, who would be called first? Brief assistants, finance and IT support on pretexting that uses real names and reporting lines, and agree on call-back rules for payment changes and password resets.

If your name is in a leaked staff directory

These steps apply to anyone whose work details appear in a directory leak, at DHS or anywhere else. They are general advice, not legal advice.

• Expect contact, not just email. Treat unexpected calls and texts that use your title or your manager's name as suspect. Call back on a number you already know.
• Protect the phone number. Ask your carrier for a port-out PIN or SIM lock, because a known mobile number is the starting point of a SIM swap.
• Freeze your credit. In the United States you place a freeze with each of the three credit bureaus; USA.gov explains how. Elsewhere, ask your local credit agencies about fraud alerts.
• Check what the join would find. Search for your personal email addresses and old passwords in breach data, and change any password you still use that appears there. Our guide to what to do when a password is in a stealer log covers the steps.
• Shrink the public layer. People-search sites and data brokers publish home addresses and family names that turn a work identity into a personal one. Opt-outs take time, and the listings come back.
• Report threats. In the United States, report extortion or fraud attempts to the FBI's IC3, and threats of violence to local police.

What the Icepick DHS leak means for leadership teams

Icepick shows in one dataset what attackers usually assemble by hand: who the leaders are, who reports to whom, which systems they use and who has exceptions. For a company, that is the executive attack surface, and directory data is only its first layer.

The second layer is what sits in breach and leak data about the same people: personal addresses that were used for work, reused passwords, accounts that survived a job change. Our analysis of what breach data shows about executives' personal accounts explains why that layer is usually larger than leaders expect. The third is the public one: home addresses, family members and travel, which make whaling and impersonation convincing.

If an executive's work identity leaks, the response is the same one we describe for an executive's password in a breach: find what is already out there, close the accounts and passwords that can be closed, and take the personal details out of public view.

How WebThreat can help

WebThreat does not audit Okta or Entra ID tenants; the directory checks above belong to your identity and security teams. Our part is the exposure that already exists outside your network, where a leaked directory gets joined with everything else.

• CEM looks at your leadership team. It finds the executives from your company name, checks their current and past email addresses against breach corpora and leak databases, and ranks the findings by what to fix first. The methodology explains how the findings are ranked.
• EDG3 is WebThreat's threat intelligence for leaked data. It watches the places where stolen company data is posted and sold, from dark web forums and marketplaces to Telegram channels and leak databases. For a domain you have authorized, it shows what has been posted about your company, where and by whom.
• Information Removal takes executives' personal data out of public view: our specialists file the opt-outs and takedown requests, verify each removal and re-check every 30 days, for families too on request.

If you want to know what an attacker could assemble about your leadership team today, contact us.

This article reflects the reporting and statements linked above as of 29 October 2026, 18:00 UTC. How the data was taken has not been confirmed by DHS or Okta, and figures may change as more of the dataset is analyzed.