DDoSecrets Publishes Database With Data on More Than 40,000 DHS Workers

The DHS data leak involves a database identified as “Icepick,” published by the DDoSecrets group. According to media analyses, the file contains identifying and contact information for more than 40,000 U.S. Department of Homeland Security (DHS) workers, including people from Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP). DHS told NPR that it is aware of a possible breach and is working to address the situation.

The publicly circulated records reportedly include names, email addresses, phone numbers, job assignments, and group memberships. The combination of contact and employment metadata may be more sensitive than the list of names itself: it may indicate which units people work in, what roles they have, or whether they may perform operational work.

The DHS Data Leak Includes Information From ICE and CBP

Media outlets describe the scope of the published file as more than 40,000 records, with some reports citing more than 41,000. Available information has not publicly confirmed how current the data is, whether the database is complete, or how many people in it can reliably be identified as workers with classified or sensitive operational assignments.

Ars Technica noted that the employment information may include data revealing sensitive roles. This increases the significance of the incident, particularly for employees whose identities or precise workplaces are not supposed to be easily discoverable. The fact that the database is already being publicly circulated represents a risk regardless of how the data was originally obtained.

The Data Source and Technical Vector Have Not Yet Been Confirmed

DHS has publicly confirmed only that it is investigating a possible breach. It has not been independently verified which system the data came from, when the breach may have occurred, or what technical method was used.

Secondary reports have suggested a possible connection to the Okta service, but that link has not been confirmed. According to those reports, Okta found no evidence that its platform had been compromised. Without official technical findings, it is therefore not possible to attribute the incident to a specific vendor, product, or type of attack.

It has also not been independently confirmed that the group operating under the name “Department of Peace” is responsible for obtaining the data. Public statements by groups or individuals do not by themselves establish the database’s origin or the method of intrusion.

The Main Risk Is Targeted Misuse of Contact Information

The published data could be used for more convincing phishing campaigns, harassment, or attempts to physically locate employees. An email address, phone number, and job title provide attackers with material for messages that may pose as internal communications, a supervisor, or a trusted service.

Information about groups and organizational assignments is also sensitive. On its own, it may not reveal the full nature of a particular person’s work, but combined with other publicly available sources, it may facilitate employee profiling and the identification of people with certain access privileges or responsibilities.

No specific compromised product has been publicly confirmed at this time. The incident therefore cannot be reduced to the question of a single software flaw or vendor.

What Will Be Important to Watch

• DHS findings on the database’s origin, the scope of the incident, and notification of affected people,
• any confirmation of the compromised system, the time of the breach, and the technique used to obtain the data,
• an official statement on the possible connection to Okta and any security recommendations,
• further mirroring of the database, its removal, or confirmed cases of data misuse.

The key question will be whether DHS publishes technical details and clarifies which categories of workers were affected by the incident. Until it does, the scope of the compromise and the file’s origin remain partly unclear.

Verified and updated: 10/30/2026 06:26