Icepick: 41,000 DHS personnel exposed in an Okta directory breach — what it means and what to do

On October 28, 2026, a leak called Icepick put the names, work emails, phone numbers and office details of 41,194 U.S. Department of Homeland Security employees and contractors in public circulation. HEROIC has analyzed the full dataset and added it to our breach database. Here is what was exposed, who is at risk, and what to do now.

What happened

The data comes from the Okta single sign-on (SSO) service DHS uses to log staff into its systems. A hacktivist group calling itself the “Department of Peace” says it took a copy of the user directory and handed it to the transparency group Distributed Denial of Secrets (DDoSecrets), which published it as “Icepick” on October 28, 2026.

The archive holds one profile file per person, organized by DHS component. Timestamps on those files point to the directory being exported in mid-August 2026, about ten weeks before the public release. The release has been covered by outlets including the BBC, Reuters and The Guardian.

This was not a stolen password database. It is a directory: the kind of information an identity system stores so that it knows who you are, where you work and how to reach you. That makes it less useful for logging into accounts, and more useful for targeting the people in it.

What was exposed, and what was not

Each record describes one person’s account. Depending on the person, it can include:

• Full name (first, middle and last)
• Job title and department
• Work email address, plus a secondary email
• Account username
• Office phone and mobile phone numbers
• Office name and street address
• Account status and creation date

The original archive also contains internal directory details: Active Directory group memberships, manager and reporting-line links, Department of Defense ID numbers, and system identifiers. Those details describe how DHS is organized and who reports to whom, which raises the stakes for the people listed.

No passwords were exposed. The password field in every record holds a placeholder, not a password or a password hash. Accounts are not directly at risk of takeover from this file alone. The risk is what attackers can do with accurate contact and job details.

Who is affected

U.S. Customs and Border Protection accounts for just over half of the records. About one in ten people listed is a contractor or other associate, identified by an “associates” email address, rather than a direct employee.

Counts are from HEROIC’s own processing of the archive. They match the per-agency totals the leakers published alongside it.

Why it matters

Accurate names, titles and phone numbers are the raw material for social engineering. With this directory, an attacker no longer has to guess who works where or who to impersonate. Expect four kinds of follow-on activity:

• Targeted phishing. Emails that cite a real title, office and colleague are far more convincing than generic spam, and far harder to filter.
• Impersonation calls and texts. Mobile numbers paired with job titles enable “vishing”: calls or texts that pose as a manager, the IT help desk or another agency.
• SIM-swap and account recovery fraud. A known mobile number plus a name is often enough to start talking a carrier or a help desk into moving a number or resetting an account.
• Harassment and physical-safety risk. The publishers say the data identifies people in sensitive enforcement and investigative roles. Office addresses and personal contact routes can expose them and their families to unwanted contact.

None of this needs a password, which is why “no passwords leaked” is not the same as “nothing to worry about.”

If you are listed

If you work or have worked for DHS, or held a DHS contractor account, assume your work contact details are now public.

1. Report it. Tell your component’s security office that you are in the Icepick release, and follow any guidance they issue.
2. Treat unexpected contact as hostile. Verify any call, text or email that asks you to act urgently, reset credentials or share information, using a number you already know rather than the one provided.
3. Lock down your mobile number. Ask your carrier for a port-out PIN or number lock so it cannot be moved to another SIM without your approval.
4. Move personal accounts off SMS codes. Where a personal account uses text-message codes, switch to an authenticator app or a hardware security key.
5. Shrink your public footprint. Review what your social media profiles, professional networking pages and data-broker listings reveal about your role, location and family, and request removals where you can.
6. Brief your household. Family members may be contacted by people posing as colleagues or officials. Agree on how you will verify each other.

For security teams

Icepick is a reminder that an identity provider’s user directory is itself a high-value dataset, even when no credential ever leaves it. Any organization running Okta or another SSO platform should take three lessons from it:

• Keep profile attributes to the minimum. Every field synced into an SSO profile (mobile numbers, reporting lines, group memberships) is one more field an attacker gets if the directory is copied. Store only what applications actually need.
• Audit who can read the directory. Review admin roles, API tokens and service integrations that can list or export users, and alert on bulk user exports.
• Harden the human channels. Help desks and account-recovery flows are where directory data turns into account takeover. Require strong identity verification before any reset, and use phishing-resistant MFA such as FIDO2 keys or smart cards.

If your organization does business with DHS, expect spear-phishing that impersonates DHS contacts by name. Warn finance and contracts staff in particular.

We will update this post if new information about the breach emerges.