Names, job titles, office locations, email addresses and phone numbers linked to 41,191 US Department of Homeland Security employees and contractors were published online on Wednesday, according to Decrypt. The dataset, known as Icepick, was released by the transparency nonprofit Distributed Denial of Secrets after an activist hacking group claimed it obtained the records from an Okta login service used by DHS.
The publication has triggered a dispute over how the information was obtained and whether the underlying systems were compromised. The hacktivist group calling itself the Department of Peace says it took the records from DHS’s Okta single sign-on service. Okta, however, said it had found no evidence that its own systems or data were breached.
DHS said it was aware of a potential breach and was working to address it. The department has also sought to have the published information removed, although it has not confirmed the full archive’s accuracy.
What the Icepick dataset contains
Distributed Denial of Secrets says the searchable archive covers 41,191 people. That total includes 21,329 employees and contractors from Customs and Border Protection, while roughly 10,000 records relate to Immigration and Customs Enforcement. About one-third of the ICE entries are associated with Homeland Security Investigations, its investigative arm.
The records include each person’s name, role, office location, email address, telephone number and manager. The archive also contains more than 55,000 internal permission groups. These groups are labels used to determine which systems or resources an employee can access, giving the file information about organizational responsibilities as well as contact details.
DDoSecrets co-founder Emma Best said the material does not include home addresses. The newest records in the archive are dated August 19, while some entries are already outdated. The source material specifically notes that some CISA employees listed in the data have since left the agency.
The dataset’s potential significance comes from the type of information it combines. A directory of government personnel can be useful for legitimate public-records requests, but security researchers also warn that lists of names, reporting lines and phone numbers could assist attempts to impersonate supervisors or identify people connected to sensitive investigations.
Conflicting accounts over the source
The Department of Peace says its action was connected to remarks by Homeland Security Secretary Markwayne Mullin about increasing ICE operations. A spokesperson for the group referred to Mullin’s July 17 statement that he was “turning up the heat,” while the group said the release was a response to the information held by Homeland Security agencies.
The group has not been independently established as the source of the records in the material provided. Distributed Denial of Secrets published the archive on October 28, but the full collection has not been verified. DHS said a sample of named employees had been matched with other records, without confirming the entire dataset.
Okta disputed the hackers’ account. “Okta is secure, and we have no evidence our data or systems were compromised,” the company told Reuters. The company’s statement leaves open the question of whether the information came from another source or whether an account or service connected with DHS was involved without a compromise of Okta’s own systems.
DHS seeks removal of the information
DHS filed a takedown notice through the security firm ZeroFox. The request asks the domain registrar to stop serving contact and location information belonging to people who did not consent to its publication.
The search site built from the dataset stopped loading on Thursday, and its domain displayed a registrar hold. Bluesky was also blocking links to the nonprofit hosting the archive. These actions have limited access to the material, but they do not resolve the uncertainty over how much of the data is accurate or how widely it may have been copied.
The episode follows another reported threat involving US government personnel. In September, the cybercrime group ShinyHunters claimed to possess between 2 terabytes and 3 terabytes of data on FBI agents and job applicants. The FBI told staff to assume that hackers had their personal information.
Moneyiar market picture
Moneyiar market data at the stated times show mixed performance among the listed digital assets:
- ONEchain (ONE) was priced at $0.1019913497, down 0.44% over 24 hours and up 1.74% over seven days, as of October 25, 2026, at 22:38 +03:30.
- Defi App (HOME) stood at $0.0065455, down 5.34% over 24 hours and 24.9% over seven days, as of August 18, 2026, at 12:14 +03:30.
- Harmony (ONE) was priced at $0.0024252125, up 1.74% over 24 hours but down 1.97% over seven days, as of October 5, 2026, at 11:34 +03:30.
These market figures are separate from the DHS data incident and do not indicate a market reaction to the publication.
