Hacker leaks data on more than 40,000 Homeland Security employees
Hacker leaks personal data of 40,000+ DHS employees after Okta SSO breach.
A threat actor calling themselves "Department of Peace" leaked personal information on over 40,000 U.S. Department of Homeland Security employees, including CBP, ICE, and CISA staff, after compromising the agency's Okta single sign-on system. The leaked database, dubbed Icepick, contains names, job titles, work emails, phone numbers, and office locations of border agents, immigration officials, cybersecurity staff, and senior DHS personnel. The actor claimed the leak was in response to government actions against ICE and stated they had access to IT records and login credentials showing which systems each employee could access.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Okta?
Get an email when a new story names Okta, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA threat actor compromised DHS's Okta single sign-on system, leveraging a centralised identity platform to gain broad access to sensitive employee data across multiple agencies including CBP, ICE, and CISA. The breach highlights the double-edged nature of SSO solutions: while they improve usability, a single point of compromise can cascade into enterprise-wide exposure. The leaked data — including names, roles, contact details, and system access credentials — creates significant risks for targeted phishing, social engineering, and physical security threats against federal personnel. This incident underscores that privileged identity infrastructure must be hardened, continuously monitored, and subject to strict least-privilege controls to limit blast radius when credentials are compromised.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Icepick