DHS: Icepick exposes 41,000 employees and their access groups

On Wednesday 28 October the transparency collective Distributed Denial of Secrets (DDoSecrets) published Icepick, an archive with data on more than 41,000 employees and contractors of the US Department of Homeland Security (DHS) and its agencies. The material comes from a hacktivist group calling itself the Department of Peace, which claims it took it from the Okta single sign-on system used by DHS. CyberScoop, TechCrunch and Wired have each verified samples of the data as authentic.

For anyone running identity and access management, the point is not just the contact details: the archive also contains directory group memberships, in other words a map of who can access what.

What happened

• The Department of Peace handed the data to journalist and hacker maia arson crimew, who shared a copy with DDoSecrets and built a website to search it (TechCrunch, Wired).
• According to Wired, the records were last updated on 19 August 2026; TechCrunch, based on the timestamps of individual records, places the exfiltration around mid-August. The breach had not been disclosed before.
• The group frames the action as retaliation against DHS immigration policies. In a note left with the files it writes: “They have our information, so it’s only fair that we have theirs.”
• DHS said it is “aware of a potential breach” and is working to address it. Okta says it is aware of the report and has no evidence that its data or systems were compromised.
• How access was obtained is unknown, as is whether the weakness has been closed: the group did not answer TechCrunch’s questions.

According to Wired, Bluesky blocks links to the archive and to the search site, flagging them as “malicious” because they contain contact details shared without authorization.

Technical details

Record contents. Name, job title, work email and mobile number, office location and, in most cases, the direct supervisor: according to Wired, that is enough to rebuild reporting lines across the whole department. TechCrunch reports that the data also includes IT and login information for each account, with the internal systems and apps each user is allowed to access.

Permission groups. The dataset lists Active Directory group memberships: Wired counts more than 55,000 groups. Group names reveal the applications in use (Microsoft 365, Citrix, Adobe Acrobat, generative AI tools, messaging and facial recognition apps, investigative analytics platforms) and, according to Wired, references to undercover operations and interception programs. TechCrunch notes groups tied to investigations into Salt Typhoon and Volt Typhoon. CyberScoop points out that some groups date back years (COVID-19 planning, internal events in 2023), so the dataset also includes legacy groups.

Breakdown. More than half of the records relate to US Customs and Border Protection (about 21,000 according to TechCrunch), about 10,000 to ICE, 6,200 to USCIS (Wired) and nearly 1,000 to CISA, more than half of them contractors according to Wired. The sources differ on the share of the workforce covered: one fifth according to TechCrunch, one seventh according to Wired.

MITRE ATT&CK (indicative mapping: the entry vector is unknown): the data matches what an attacker collects with T1087 (Account Discovery) and T1069 (Permission Groups Discovery); downstream it enables T1589 (Gather Victim Identity Information), T1591 (Gather Victim Org Information) and T1656 (Impersonation).

Why it matters

A Recorded Future analyst quoted by Wired notes that, if authentic and current, this data is a highly valuable intelligence resource for anyone seeking to penetrate DHS: correlated with other leaks and commercial data, it can help identify vulnerable personnel, craft convincing impersonations or compromise ongoing investigations.

The same logic applies to any company: an export from the identity provider with roles, supervisors and groups is the ideal basis for spear phishing, calls to the IT help desk to reset passwords and MFA, and fraud in which the attacker poses as a manager.

Impact for European and Italian companies

• Organizations that work with DHS agencies (suppliers, partners, airlines and logistics companies dealing with CBP) should expect messages using real names, roles and phone numbers.
• The identity provider is a single point: Okta and similar services are widely used in Europe too. NIS2 (Article 21) requires access control measures and multi-factor authentication; the Italian transposition (Legislative Decree 138/2024) also covers public administrations.
• GDPR: employees’ work contact details are personal data too; an exfiltration of the directory must be assessed for notification to the supervisory authority within 72 hours.

What to do now

1. Check your identity provider logs: bulk reads of users and groups via API, new API tokens, administrative role assignments, sign-ins from unusual devices or networks, for at least the last 90 days.
2. Reduce the privileges of tokens and service apps: no long-lived admin tokens, read-only permissions limited to what is needed, regular rotation.
3. Phishing-resistant MFA (FIDO2/WebAuthn) for administrators, IT help desk and privileged users.
4. Help desk procedures: reset passwords and MFA only after out-of-band verification, never on the basis of a stated name and role.
5. Group names: this case shows that permission names reveal projects and activities. For sensitive groups, use opaque codes and document their meaning elsewhere.
6. Directory cleanup: remove stale groups and accounts; the DHS dataset contained groups from years ago.
7. Prepare your staff: if your directory ends up online, warn employees immediately and raise awareness of emails and calls that quote internal data.

How ARXDOME helps

ARX Sentry collects events from computers, servers and firewalls and, in its identity pages, highlights privileged logons, bursts of attempts, night-time logons and account changes. ARX Expose flags company accounts involved in breaches and lookalike domains registered by others, often used for impersonation. With ARX Horizon you can query threat intelligence sources about suspicious indicators directly from the portal.

Last updated: 29 October 2026