A hacker has published records on more than 40,000 US Department of Homeland Security employees and claims they came from the Okta single sign-on system DHS uses. Okta says it has no evidence of a compromise and the method is unconfirmed, but the leak shows how much a directory of users and app access reveals.
What happened
TechCrunch reported on October 28 that a hacker using the handle "Department of Peace" stole the data in a previously undisclosed breach. SecurityWeek counts more than 41,000 records. TechCrunch's approximate breakdown is 21,000 from Customs and Border Protection, 10,000 from ICE and Homeland Security Investigations, and just under 1,000 from CISA, with thousands more from other components.
Reported contents identify each person by name, title and office location, and give a work email and phone number. They also show access: the internal apps and systems tied to the account. TechCrunch also describes Active Directory group memberships. Neither report lists passwords among the fields. Distributed Denial of Secrets holds a copy and calls the database "Icepick."
- Authenticity: TechCrunch looked up several DHS employees it already knew of in an offline copy. Their names matched, so it considers part of the data genuine.
- Timing: TechCrunch says record timestamps point to exfiltration around mid-August 2026.
- Method: the Okta link is the hacker's claim. The hacker did not answer TechCrunch's question about how the breach was carried out, and TechCrunch says it is unclear whether the weakness has been fixed.
- DHS: a spokesperson acknowledged a potential breach and said the department is responding, with further public updates to follow once it has more to share.
Okta is secure, and we have no evidence our data or systems were compromised. — Okta spokesperson
Why it matters
Don't read this as an Okta platform incident. Neither report shows one, and a claim about where data came from doesn't establish how it was taken. The lesson holds whatever the root cause, and for any identity provider.
Entitlement data is sensitive in its own right. In SecurityWeek's coverage, Illumio public sector CTO Gary Barlet called the access information the most concerning part, because it maps who can reach which systems and whom to target. In our view, that map plus a phone number and job title is raw material for convincing phishing or help desk impersonation, even without a credential.
Group names leak too. TechCrunch read tooling and investigative work from them, including groups referencing Penlink and the Mobile Fortify facial-recognition app. It also found about 4,500 users in a "Headspace_users" group, although Headspace's ICE contract ended in 2023. The reports don't say whether that group still grants anything, but it looks like the kind of leftover an access review should catch.
What to check in your environment
- List who can read the whole directory. Okta's read-only administrator role can view users, groups, apps and reports. Count those holders alongside your super admins and remove what isn't needed.
- Review API tokens. Okta says an SSWS token takes on the privilege level of the admin who created it. Reissue tokens from dedicated service accounts with narrower privileges and restrict them to known IP ranges. Okta strongly recommends OAuth 2.0 with short-lived access tokens instead.
- Test your detection of bulk reads. Run a sanctioned directory export or API pull, then confirm what appears in your System Log and SIEM. Okta's log can be filtered by the API token that triggered an event. Don't assume a read was logged until you've seen it.
- Check log retention. Okta's System Log API doesn't return events older than 90 days. For a longer investigation window, stream logs elsewhere.
- Audit group names and stale groups. Find names that disclose sensitive programs or tools and rename them where you can. Remove app groups whose vendor relationship has ended.
- Find the other copies. The same user and entitlement data can live in Active Directory, governance tools, HR feeds and spreadsheet exports. Review those too.
- Prepare for targeted contact. Have the help desk verify callers using more than directory details such as names, numbers and titles. If your staff hold DHS accounts as contractors, warn them; TechCrunch says contractors use the same SSO system, though neither report breaks out contractor records.