More Than 41,000 DHS Personnel Records Published Online

A leak site published records described as identifying more than 41,000 DHS employees and contractors. Independent checks found authentic records, but the full dataset and acquisition route remain unverified.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

Luminous blue shield around five abstract directory cards as red data fragments scatter across a dark operations room.
AI-generated editorial illustration of a protected personnel directory amid scattered data fragments. Not official DHS, CISA or Okta imagery.

More Than 41,000 DHS Personnel Records Published Online12

A leak site published a database described as identifying more than 41,000 U.S. Department of Homeland Security employees and contractors.12 Independent spot checks found authentic current and former personnel records, but the reviewed reporting did not validate every row or prove how the data was obtained.23

DATA EXPOSURE • Reporting cutoff: October 28, 2026, 6:12 p.m. EDT1234

The bottom line

The publication of a large DHS workforce directory and partial independent verification are supported by the reviewed sources.1234 The claim that the data came from a DHS-used Okta service remains attributed to the source group; Okta says it has no evidence that its data or systems were compromised, and DHS had not responded to CyberScoop by the cutoff.12

Verified facts

Reported scaleMore than 41,000 DHS employees and contractors, according to DDoSecrets and CyberScoop.12
Reported fieldsNames, offices, contact information and assignments; TechCrunch also reported job titles and work contact fields.14
Partial verificationCyberScoop verified numerous current CISA employees and some former leaders; Reuters separately reported matching six records and directly confirming details with three employees.23

What happened

DDoSecrets published its “Icepick” article on October 28 and described an internal database identifying more than 41,000 DHS employees.1 The public article says a group calling itself the Department of Peace obtained the data from an Okta single sign-on service used by DHS.1 That acquisition route is an allegation, not an independently established fact.

CyberScoop reported the same source-group claim and quoted Okta: “Okta is secure, and we have no evidence our data or systems were compromised.”2 CyberScoop also said DHS did not immediately respond to its request for comment.2

What the reporting establishes — and does not

Reuters said it could not immediately verify the entire trove.3 It reported matching personal information for six DHS employees against other records and directly confirming phone numbers or other details with three employees.3 CyberScoop independently said it verified numerous current CISA employees and some former leaders.2

Those checks support that authentic records are present; they do not establish that every entry is authentic, current or unique, and they do not prove an Okta platform breach.23 The reviewed sources use both “more than 40,000” and “more than 41,000,” so this article preserves those source-specific ranges rather than asserting an independently verified exact total.1234

Why it matters

The reported fields include names, roles and work contact channels tied to federal personnel.14 As practical defensive guidance, readers should treat unexpected messages that invoke DHS personnel or internal details as potentially deceptive and verify the sender through a separately obtained channel.5

What this means for readers

  1. Verify through a separate channel. CISA says that if a suspicious message might be real, do not use a link or phone number in the message; look up another way to contact the company or person directly.5
  2. Do not use the published dataset to “verify” a sender. A matching job title, office, email address or phone number does not prove that the person contacting you controls that identity. Use an official directory or a contact method you obtained independently.145
  3. Use stronger sign-in protections where available. CISA says businesses should aim to use phishing-resistant MFA.6

What remains unknown

The reviewed sources do not establish the complete dataset’s authenticity, its exact unique-record count, the acquisition date, the initial access route, whether credentials or session material were included, or whether every listed person was notified.1234

No DHS or Okta first-party incident notice was found in the reviewed source set by the reporting cutoff. That bounded observation is not proof that no internal investigation or response exists; it means this article relies on the public leak-site description, independent reporting and Okta’s quoted statement.1234

Sources

  1. Icepick — Distributed Denial of Secrets, October 28, 2026. Public article only; this article does not link to or reproduce the dataset.
  2. Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists — CyberScoop, October 28, 2026.
  3. Leak Website Releases Data on Tens of Thousands of DHS Employees — Reuters via U.S. News, October 28, 2026.
  4. Hacker stole personnel data about thousands of Homeland Security employees — TechCrunch via Yahoo, October 28, 2026.
  5. Recognize and Report Phishing — CISA, accessed October 28, 2026.
  6. Require Multifactor Authentication — CISA, accessed October 28, 2026.

Update and correction note: This article reflects the six public sources checked through October 28, 2026, 6:12 p.m. EDT; later changes require a new source review before publication.123456

Browse Articles

Latest Articles