A hacktivist group calling itself the "Department of Peace" says it stole internal work records on more than 41,000 Department of Homeland Security employees and contractors, CyberScoop reported. The transparency nonprofit Distributed Denial of Secrets (DDoSecrets) published the trove on Wednesday, Oct. 28, 2026, Reuters reported. The exact hour of release in Eastern Time has not been made public. The DHS data breach covers staff at Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), Homeland Security Investigations (HSI) and other components, and includes group labels tied to undercover work.
DHS said late Wednesday that it was "aware of a potential breach," according to CyberScoop. As of Friday, Oct. 30, the department had not confirmed how the data was taken or how many people were affected. The group says it took the records from an Okta single sign-on service used by DHS. Okta denies that its systems were compromised.
By Thursday a DHS contractor was trying to get the searchable archive taken offline. It went down for a time and then came back through a different registrar. Ecker Geopolitics has not accessed the leaked dataset and does not link to it.
Key Facts
- When: DDoSecrets published the data on Wednesday, Oct. 28, 2026. DHS acknowledged a "potential breach" late that day. The search tool went offline and came back on Thursday, Oct. 29.
- Where: The data was posted online by DDoSecrets and was searchable through a tool called "Icepick." DHS is headquartered on the St. Elizabeths campus in Washington, D.C.
- Who: The "Department of Peace" hacktivist group, DDoSecrets co-founder Emma Best, and Swiss hacker and journalist maia arson crimew.
- What: Work-related data including names, work email addresses, phone numbers, job titles, office locations and internal access-group memberships.
- Scale: More than 41,000 records, per CyberScoop. That includes more than 21,000 CBP personnel, according to the BBC as cited by The Next Web.
- Status: Developing. DHS calls it a "potential breach." Reuters confirmed a sample of the records, but nobody has independently verified the full dataset.
What Happened
Reuters reporters Raphael Satter and AJ Vicens reported that DDoSecrets announced the release on Wednesday. They described the data as covering ICE, CBP, HSI, the Cybersecurity and Infrastructure Security Agency (CISA) and other component agencies. Job titles and email groups in the records pointed to assignments in special operations, surveillance, computer forensics and undercover work, the Reuters report said.
Straight Arrow News reported that U.S. Citizenship and Immigration Services, the Federal Protective Service, the Federal Law Enforcement Training Centers and the Science and Technology Directorate also appear in the data. According to Reuters, the group said in a statement released with the files that DHS employees "have our information, so it's only fair that we have theirs."
The group tied the operation to a July 17 remark by DHS Secretary Markwayne Mullin about "turning up the heat" on ICE operations, Gizmodo reported. DDoSecrets co-founder Emma Best told Reuters that crimew's public search tool would "replace anonymity with accountability," according to FOX 9.
A DHS spokesperson, who was not named, gave several outlets the same statement.
"DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively." - DHS spokesperson, as reported by The Epoch Times
The spokesperson added that the department would update the public "when more information is available," Gizmodo reported. No DHS official has been quoted by name. Ecker Geopolitics could not find a statement on dhs.gov as of Friday.
On Thursday the fight moved to the infrastructure hosting the data. DHS contractor ZeroFox asked the Icelandic host FlokiNET to remove the archive, and FlokiNET refused, CyberScoop reported. ZeroFox said its request rested on two facts: "the data was stolen" and it identifies and locates real people.
The registrar CentralNic put the search site's domain on hold. The site later came back under a different registrar, according to CyberScoop. Bluesky began blocking links to the archive, The Next Web reported, citing WIRED.
Timeline
| Date/Time (ET) | Event |
|---|---|
| 2014 | An earlier breach may have exposed data on about 390,000 DHS employees, applicants and contractors (background) |
| Jan. 13-14, 2026 | The ICE List website publishes details it says cover about 4,500 ICE and Border Patrol employees (separate event) |
| Mar. 1, 2026 | The "Department of Peace" claims a DHS hack and DDoSecrets publishes ICE contract data on more than 6,000 companies |
| July 17, 2026 | Secretary Mullin makes the "turning up the heat" remark the hackers later cite |
| Aug. 19, 2026 | Last update date found in the leaked records |
| Sept. 2026 | ShinyHunters claims a theft of FBI employee data (separate event) |
| Oct. 28, 2026 | DDoSecrets publishes data on more than 41,000 DHS staff; DHS acknowledges a "potential breach" late in the day |
| Oct. 29, 2026, morning | The search site goes offline after a registrar hold, then returns under another registrar |
| Oct. 30, 2026 | No named DHS official, FBI or congressional statement located by Ecker Geopolitics |
Sources for the background rows: the 2014 breach and earlier incidents, the March 2026 contract leak and the January 2026 ICE List episode. These were separate incidents. None of them is the October 2026 leak.
Who's Involved
- Department of Peace: A hacktivist group opposed to ICE that claims it took the data. In March 2026 it claimed a separate DHS hack that exposed contractor records.
- Distributed Denial of Secrets: The nonprofit that published the archive. Co-founder Emma Best disputes that the data includes home addresses or personal contact details.
- maia arson crimew: The Swiss hacker and journalist who built the Icepick search tool. Crimew was indicted in the United States in 2021 on hacking charges but has not been convicted, Straight Arrow News noted.
- Department of Homeland Security: Calls the incident a potential breach. It has not named a cause or confirmed the scope.
- Okta: Its spokesperson said "Okta is secure, and we have no evidence our data or systems were compromised," per CyberScoop.
- ZeroFox and FlokiNET: ZeroFox is a DHS contractor that sought removal of the data. FlokiNET is the Icelandic host that refused that request.
- FBI and CISA: Ecker Geopolitics found no public confirmation of an FBI investigation into this leak. CISA staff appear in the data, but the agency had made no public statement as of Friday.
- Congress: Ecker Geopolitics found no on-record statements from lawmakers about this specific leak as of Friday afternoon.
The OSINT Picture
Partial authenticity: high confidence. Reuters matched the details of six named employees against credit bureau records and breach data from District 4 Labs. It also reached three employees by phone, and they confirmed their details, according to the wire report. CyberScoop separately confirmed that current CISA employees appear in the set.
Data is partly historical: moderate-to-high confidence. Nextgov/FCW found that some records appear to be historical, naming CISA employees who have since left the agency, as summarized by The Next Web. The records run to an Aug. 19, 2026 update date.
Undercover-linked groups: moderate confidence. WIRED found 39 HSI employees in groups containing "CUC." Court filings say that abbreviation stands for "certified undercover operation," The Next Web reported. Membership shows access, not necessarily a covert role.
Okta as the entry point: low confidence. This claim comes only from the hackers and DDoSecrets. Reuters could not corroborate it, and Okta denies any compromise.
Exact counts by component: low-to-moderate confidence. Outlets came up with different numbers. WIRED counted about 10,000 ICE records and the BBC counted nearly 6,600.
Geopolitical Players
The infrastructure behind the leak crosses borders. The archive's host, FlokiNET, is based in Iceland, and the person who built the search tool is Swiss. Alexander Leslie of Recorded Future warned that the data could help adversaries, The Next Web reported. No foreign government has claimed involvement, and Ecker Geopolitics found no official foreign-government reaction.
U.S. officials have warned about foreign targeting of American personnel. On Oct. 25, the DNI warned of Iranian plots against Americans. The exposure of undercover-linked DHS staff also echoes concerns in Ecker Geopolitics' earlier report on a Pentagon deep-cover spy program.
What It Means for the United States
Benefits and opportunities
- Analysis: The incident gives Congress and DHS a clear case for hardening identity and single sign-on controls across federal agencies. That matters after a run of federal security lapses, including the PHP flaw that forced government websites offline.
- Analysis: The fast takedown campaign by ZeroFox shows that DHS already has a contracted way to fight the spread of stolen data.
- Analysis: It strengthens the case for a federal doxxing law for officers. A bill on that issue was introduced in 2025, according to Wikipedia's account of the January 2026 ICE List episode.
Risks and dangers
- Security: Officers in undercover-linked access groups could face exposure, harassment or targeting by cartels and hostile intelligence services.
- Operational: Exposed internal tool groups and organizational charts may reveal investigative methods and programs that had not been disclosed.
- Domestic: This is the third major government data leak in about a month, Reuters noted. The pattern may embolden activists who oppose ICE.
- Legal and fiscal: The Defense Department faced a class action over a recent breach, according to Reuters. DHS could face similar litigation.
Stay ahead of the next breach. Pro Truth Seeker members get the daily Intel Briefing, members-only deep dives and the full archive. Join today.
What's Next
DHS has said it will update the public "when more information is available." No date has been set. The fight over whether the Icepick archive stays online between ZeroFox and the archive's hosts and registrars is ongoing.
Watch Ecker Geopolitics for live coverage, and cast your vote in today's poll.
Sources
- CyberScoop: Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists - October 28, 2026
- CyberScoop: Leaked DHS employee archive, Icepick, faces challenges to stay online - October 29, 2026
- GV Wire (Reuters): Leak Website Releases Data on Tens of Thousands of DHS Employees - October 28, 2026
- Straight Arrow News: Shielded by DHS, immigration agents' identities exposed in massive data breach - October 28, 2026
- The Epoch Times: 41,000 Homeland Security Employees and Undercover ICE Agents Exposed in Data Leak, Hackers Say - October 28, 2026
- Gizmodo: Data From More Than 41,000 DHS Workers Exposed in Massive Leak - October 29, 2026
- The Next Web: Leak exposes 41,000 Homeland Security staff, including ICE and CBP agents - October 29, 2026
- FOX 9: Personal information of thousands of DHS employees potentially leaked in data breach - October 29, 2026
- TechCrunch: Hacktivists claim to have hacked Homeland Security to release ICE contract data - March 2, 2026
- Wikipedia: Department of Homeland Security employee data leak (January 2026 ICE List episode) - accessed October 30, 2026