The Icepick Leak Is a Map of DHS, Not a Password Dump

On October 28, 2026, a dataset named "Icepick" was published online through the transparency nonprofit Distributed Denial of Secrets. It contains records on more than 41,000 current and former U.S. Department of Homeland Security employees and contractors. A hacktivist group calling itself "Department of Peace" claimed responsibility.

The exposed fields are not passwords. They are names, work addresses, phone numbers, email addresses, job titles, office locations, supervisors, internal group memberships and job assignments. Reports name ICE, CBP, USCIS, CISA, HSI and DHS headquarters among the affected components, with CBP accounting for more than half the records according to one report. One report says the records were last updated on August 19, 2026.

Researcher and journalist Maia Arson Crimew built a search tool for the records. She said she was not involved in procuring the data and worked on the story as a journalist conducting source work, research and data work.

The Department of Peace claimed it obtained the data by leveraging DHS's use of Okta's single sign-on service. That claim is the part DHS has not verified. DHS has not confirmed a breach. POLITICO could not independently verify the dataset's authenticity, though Reuters and TechCrunch matched information from the leak to third-party records and known names of DHS employees.

That distinction matters. The entry vector is a claim.

A directory leak is not a credential dump, but it is operationally dangerous in a different way. Names, emails, phone numbers, office locations, job titles and reporting lines give an adversary a map of who works where inside DHS and its component agencies, including staff tied to sensitive operations such as undercover ICE work. For federal employees, the exposure can enable targeted phishing, impersonation and physical targeting. For DHS, it raises questions about identity-layer security and whether single sign-on infrastructure was the entry point.

The incident adds to a string of recent cyber incidents targeting federal agencies.

Treat the directory as a targeting list, not a data-loss statistic.

DHS has not confirmed a breach. Until it does, the Okta claim remains attributed to the group that made it.