By George News | Oct 30, 2026
What happened
On Oct 28, 2026, the transparency collective DDoSecrets published “Icepick,” a set of work records on more than 41,000 DHS employees and contractors. The records include names, work emails and phones, offices, titles and internal permission groups. WIRED previewed the data and reported that some of those groups relate to undercover work, wiretaps and tools such as Palantir (WIRED; archive).
The source calls itself the “Department of Peace.” It says the records came from DHS’s Okta single sign-on system (DDoSecrets). CBP accounts for more than half of the records. Outlets disagree on how many are ICE: WIRED and NPR say about 10,000, while the BBC and the Guardian say about 6,600 (NPR; BBC; Guardian). DDoSecrets says the set is not a full directory and calls it “business-card” data, not home addresses.
Within a day, DHS said it was “aware of a potential breach.” Okta said it had no evidence its systems were compromised. Bluesky blocked links to the data as malicious. And the search site built by Swiss hacker and journalist maia arson crimew, icepi.cx, went offline Thursday morning after its registrar, CentralNic, put the domain on hold following a takedown push by ZeroFox, a contractor ICE authorized to seek content removals (TechCrunch; WIRED). It was back within hours under a new domain from a different registrar, still hosted by the Icelandic company FlokiNET, which refused ZeroFox’s request (CyberScoop; POLITICO Pro). The raw archive remains on DDoSecrets, which has also released the search site’s source code.
George News has not accessed, downloaded or searched the leaked data, and will not. This piece relies only on published reporting.
The same actor as March?
This is not the Department of Peace’s first DHS release. On March 1, 2026, DDoSecrets published records on 6,681 applicants to DHS’s Office of Industry Partnership, with a note citing the Minneapolis killings of Alex Pretti and Renée Good (DDoSecrets; TechCrunch).
The two releases share a name, a publisher and a voice. The March note is written in the first person singular (”I’m releasing this”) and is casual and pun-heavy. Both leaks are tied to a news event: the Minneapolis killings in March, and DHS Secretary Markwayne Mullin’s July 17 promise to keep “turning up the heat” in October (NPR; CyberScoop). Our read, with medium confidence, is that one author is behind both. No outlet or official has publicly identified that person, and we will not guess.
Open questions
1. Okta flaw, or stolen DHS credentials? Okta says: “Okta is secure, and we have no evidence our data or systems were compromised.” That statement is narrower than it sounds. It does not rule out a compromised DHS tenant, a phished administrator, stolen credentials or a weak integration, which is the point Computing makes. The hacker did not answer press questions about how they got in, and DHS has not said. Reuters reportedly could not corroborate the Okta claim either.
2. Why the ten-week gap? The records were last updated Aug 19, 2026 (WIRED). The release came Oct 28. No source explains what happened in between. Did DHS detect the access? Were the credentials revoked? Did anyone at DHS know this data was out for two months?
3. Who got it first? TechCrunch reports crimew shared the data with DDoSecrets; DDoSecrets says the group sent copies to both (TechCrunch). The chain of custody matters for any prosecution.
4. Can a takedown campaign contain this at all? CentralNic placed icepi.cx on serverHold, but the site reappeared on a new domain the same day, and DDoSecrets has published the archive, torrents and the site’s source code. FlokiNET refused ZeroFox, arguing the records are “work identities of government employees,” not private data. ZeroFox’s letter, cited by the Guardian, says the database “places more than 40,000 identifiable individuals at risk of harassment, stalking and physical harm,” and rests on two facts: the data was stolen and it identifies real people (Guardian; CyberScoop). Whack-a-mole with registrars is not containment. Who else got notices, under what legal theory, and is DHS pursuing anything beyond takedowns?
The national security risk
Most of these records are office directory entries. The danger is in the permission groups. A list showing which employees belong to undercover or surveillance-related groups can expose people whose safety depends on not being known, along with their ongoing cases and sources. Fox News reports it confirmed undercover ICE agents appear in the data (Fox News).
That risk is no longer theoretical. The Washington Post reported on Oct 30 that SITE Intelligence Group, which monitors violent extremists, found the leak fueling violent rhetoric online. An account tied to an anarchist movement in Colorado posted information about five DHS employees working in one city, and several accounts on Instagram, Threads and X called for killing officers and harming their families (Washington Post).
Security researchers also warn that a single sign-on export is a roadmap for phishing and impersonation. It tells an adversary who has access to what, and whom to target (Computing; Yaamlabs). Foreign intelligence services do not need to have stolen this themselves. They just need to download it.
Accountability, in both directions
There are two accountability stories here, and they should not cancel each other out.
The first is DHS’s. This is at least the second breach by the same actor in eight months, after a string of federal incidents including the FBIJobs.gov breach that the FBI blamed on a contractor’s missed patch (NBC News). Congress should ask DHS when it detected the intrusion, how access was obtained, whether affected employees, especially those in sensitive roles, have been notified and protected, and what changed after March.
The second is the publishers’. DDoSecrets frames the release as “replacing the regime’s anonymity with accountability.” Transparency about government power is legitimate. But identifying rank-and-file and undercover personnel is a different act from exposing policy, and it carries real risk to people. Federal law (18 U.S.C. 119) bars publishing covered officials’ personal information with intent to threaten or incite violence, and as FIRE’s Adam Steinbaugh notes to WIRED, intent is the test. Doxing bills are already pending in Congress (Rep. Pfluger).
What to watch
A DHS or inspector general statement on the method of entry and the Aug 19 to Oct 28 gap
Any DOJ charging documents naming the Department of Peace
Whether Okta revises or expands its statement
Congressional letters or hearings on DHS identity security
Further takedown attempts against the new domain, FlokiNET or DDoSecrets, and whether DHS escalates beyond contractor notices
Sources
WIRED, “Massive Leak Exposes 41,000 Homeland Security Workers, Including Undercover ICE Agents,” Oct 28, 2026: https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/ (archive: https://archive.ph/Erqhn)
WIRED, Bluesky block: https://www.wired.com/story/bluesky-blocks-links-to-major-leak-of-dhs-data/
DDoSecrets, Icepick: https://ddosecrets.org/article/icepick
DDoSecrets, DHS Contracts (March): https://www.ddosecrets.org/article/ice-contracts
NPR: https://www.npr.org/2026/10/28/nx-s1-6021497/dhs-hack-ice
TechCrunch, Oct 28: https://techcrunch.com/2026/10/28/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-agents/
TechCrunch, Oct 29: https://techcrunch.com/2026/10/29/bluesky-blocks-links-to-leaked-dhs-employee-data-as-government-seeks-takedowns/
TechCrunch, March: https://techcrunch.com/2026/03/02/hacktivists-claim-to-have-hacked-homeland-security-to-release-ice-contract-data/
CyberScoop: https://cyberscoop.com/dhs-employee-data-leak-ddosecrets/
The Guardian: https://www.theguardian.com/us-news/2026/oct/28/homeland-security-data-leak
Computing: https://www.computing.co.uk/news/2026/security/hacktivists-leak-data-41000-homeland-security-workers
Yaamlabs: https://yaamlabs.com/blog/dhs-okta-staff-directory-leak
The Guardian, Oct 29 (ZeroFox letter): https://www.theguardian.com/us-news/2026/oct/29/dhs-personnel-data-leak
CyberScoop, Oct 29 (takedown and relaunch): https://cyberscoop.com/dhs-employee-breach-icepick-database-takedown/
POLITICO Pro, Oct 29: https://subscriber.politicopro.com/article/2026/10/ice-dhs-leak-takedown-request-01140645
BankInfoSecurity, Oct 29: https://www.bankinfosecurity.com/dhs-strikes-back-targeting-icepick-leaks-a-33249
Washington Post, Oct 30 (SITE finding): https://www.washingtonpost.com/immigration/2026/10/30/hack-homeland-security-workers-data-fuels-violent-rhetoric-online/
Rep. Pfluger: https://pfluger.house.gov/news/documentsingle.aspx?DocumentID=2984