Massive DHS Employee Data Leak via Okta Exposes Undercover ICE Agents and Sensitive Operations

An unprecedented hacktivist operation on Wednesday (October 28) exposed the personal records of more than 41,000 workers at the U.S. Department of Homeland Security (DHS) — approximately one-fifth of the department's entire workforce — through a vulnerability in the Okta single sign-on (SSO) system. The dataset, dubbed "Icepick" by the transparency organization DDoSecrets, includes names, work addresses, phone numbers, job titles, and internal system permissions, with details reaching as far as exposing ICE agents operating under undercover roles.

The access to records was obtained by a group calling itself the "Department of Peace," which distributed the material to DDoSecrets and also to a U.S.-based journalist, Ryan Ottignon, and a Swiss hacker known as "maia arson crimew." According to the group, the data was compiled based on information acquired through an attack on Okta's single sign-on system, the same identity management service used by millions of federal workers to access their corporate accounts.

What was exposed

The compromised records span seven component agencies of the DHS, including:

- 21,000 records of U.S. Customs and Border Protection (CBP) employees, accounting for more than half the total - 7,000 records from Immigration and Customs Enforcement (ICE) personnel and its Homeland Security Investigations (HSI) division - Nearly 1,000 records from the Cybersecurity and Infrastructure Security Agency (CISA) - Additional data from DHS headquarters and other units

Beyond basic contact details — full names, job titles, work addresses, emails, phone numbers, and office locations — the leak includes more sensitive information about internal software permissions, access groups for surveillance tools, mobile location tracking systems, and facial recognition software. Names of covert operations and technical details used in those operations, including technologies provided by companies like Cellebrite and Palantir, were also revealed.

The records were last updated on August 19, 2026, meaning the exposure covers relatively recent workforce data from the department.

The attack vector: Okta under pressure

Okta, the global leader in identity and access management, stated in a communication that its core infrastructure remains secure with no evidence of system compromise. The company has already faced multiple security incidents in recent years — including the famous 2022 breach caused by the Lapsus$ group and a more recent incident linked to employee credentials saved to personal Google accounts — raising questions about the robustness of its security model against targeted attacks on the identity sector.

The DHS attack comes in a worrying context: Okta continues to face the consequences of stolen credential access. In late October 2023, the company discovered that an employee had saved service credentials to their personal Google account, allowing an attacker to access files for 134 clients. More recently, in October 2026, Cloudflare disclosed it had been breached using tokens and credentials stolen during a previous Okta incident.

Official reactions

DHS issued a statement confirming it is aware of the incident and that protective measures are actively underway. However, the department did not respond to press requests for comment, fueling speculation about the real extent of the damage and the level of preparation to contain the exposure of agents.

The FBI referred inquiries to DHS, while the Department of Justice did not comment. The absence of an official response contrasts with the severity of the exposed data — including the names of agents operating under cover in intensified deportation programs, who could be directly at risk of reprisals.

What the exposure means

For the exposed employees, the guidance is clear: monitor accounts, change credentials, and stay alert for targeted harassment or pursuit. Agents who worked on sensitive border and deportation operations, in particular, face risks that go far beyond the nuisance of spam or phishing — they could be literally in physical danger.

The incident reinforces an increasing tension in the cybersecurity sector: as governments and companies migrate to centralized identity solutions like SSO, the value of a single point of failure increases exponentially. Okta, in itself, is not the problem — it's the fact that when access to the platform is compromised, doors to thousands of different organizations open simultaneously.

The question that remains: in a world where digital identity has become the new security perimeter, how many layers of protection are truly sufficient before the first weak link breaks?

Sources: WIRED, NPR, The Verge

✓ Independent sources cross-checked and verified before publishing