U.S. Department of Homeland Security (DHS) Data Breach
In October 2026, a threat actor operating under the alias "Icepick" compromised an Okta single sign-on (SSO) directory environment used by the U.S. Department of Homeland Security (DHS) and exfiltrated an internal workforce roster covering 41,191 federal employees and contractors.
Exposed Data Types
6- Names
- Email addresses
- Phone numbers
- Job titles
- Employers
- User IDs
About This Breach
The leaked dataset spanned personnel from U.S. Customs and Border Protection (~21,000 staff), Immigration and Customs Enforcement (~10,000 staff), Homeland Security Investigations (HSI), and the Cybersecurity and Infrastructure Security Agency (CISA).
Exposed fields included full names, official government (.gov) email addresses, work telephone numbers, job titles, assigned agencies and organizational units, and internal directory user identifiers.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
