One DHS Login System Gave a Hacker 41,000 Workers' Names, Phones and Desks

Song "ICEPICK" — industrial boom-bap, three minutes thirty-eight, one story.

On October 28, 2026, a transparency nonprofit published personnel records on more than 41,000 employees and contractors of the U.S. Department of Homeland Security 1. A group calling itself Department of Peace says the file came out of an Okta single sign-on system — the identity layer that lets DHS staff and contractors across its agencies log in to the department's central network, and the same system that records which internal apps each account is allowed to reach 1.

More than half the records — about 21,000 — belong to Customs and Border Protection, whose staff work the airports and ports of entry; about 10,000 belong to ICE and its Homeland Security Investigations unit; just under 1,000 belong to CISA, the cybersecurity agency 1. The New York Times puts the total at more than 41,000, about 15 percent of a department of more than 260,000 people 2.

Each record carries a name, job title, work email, cell number and office location. Each also carries the account's membership in the department's Active Directory user groups, which is the list of systems that account can enter: Microsoft 365 for most of them, about 4,500 in a group named Headspace_users from an ICE mental-health contract that ended in 2023, dozens of groups tied to Penlink surveillance tools with more than 2,000 users across HSI, more than 200 CBP accounts in a Mobile Fortify facial-recognition group, and a few senior officials' accounts in ChatGPT groups 1.

Timestamps on the records put the theft around mid-August, two and a half months before publication. DHS says it is aware of "a potential breach" and is working to address it; Okta says its own data and systems were not compromised, and nobody has said how the accounts were reached 1.

Then the fight over the file. DHS sent takedown notices through ZeroFox, a vendor authorised to act for the department through 2028, and asked the Icelandic host FlokiNET to pull the data, saying it placed more than 40,000 identifiable people at risk of harassment, stalking and physical harm. FlokiNET's chief executive refused, saying the file holds work addresses and work phones, not personal ones 3. The searchable site, named Icepick, went dark when its registrar locked the domain and came back on a different one the same day; Bluesky blocked links to the host as malicious, then said it would reword the warning 4.

It is at least the third compromise of U.S. government personnel data in a little over a month: ShinyHunters and an FBI hiring portal in September, and about 3 million Pentagon personnel records left exposed for roughly nine months by a misconfigured file transfer. Those were not published. This one was 2.

Reporting cut off at October 29, 2026. The next episode is whatever DHS says about how the door was opened, or whoever else is breached next.