Hackers Expose Data of 41,000+ DHS Employees in Okta Breach

Hackers stole personal details of 41,000+ DHS employees by exploiting Okta on October 26.

On October 26, 2026, a hacking group known as Department of Peace exploited a vulnerability in the Department of Homeland Security’s (DHS) Okta single sign-on (SSO) platform—a tool used to manage employee access to various internal systems. This unauthorized access allowed the hackers to extract personal information on over 41,000 DHS employees, representing nearly 20% of the workforce. The stolen data was publicly released two days later, on October 28, in a dataset named "Icepick."

Okta SSO simplifies login for employees across multiple DHS systems by authenticating users once and granting broad access. When compromised, it can expose extensive internal information, as seen here. The leaked data includes names, job titles, work phone numbers, email addresses, and physical office locations, and notably covers personnel from U.S. Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP).

Swiss security researcher maia arson crimew, who helped build the searchable tool for the leaked data, states the breach offers an unprecedented view into DHS’s organizational structure. Journalist Emma Best highlighted that the release may increase accountability by exposing what had been anonymous, potentially influencing investigations and congressional oversight.

Federal cybersecurity experts and privacy advocates warn this incident reveals critical vulnerabilities in protecting sensitive employee data at a national security agency. While DHS’s official response details are limited publicly, the breach signals an urgent need for legal and compliance teams to assess risks around data security, employee privacy obligations, and breach notification procedures under federal law.

Given the scale and sensitivity of this leak, law firms and corporate counsel managing government contracts or handling federal employee data should closely monitor developments and review their cybersecurity and compliance frameworks accordingly.

Yes, but: DHS has not publicly disclosed how long the Okta credentials were compromised or detailed its internal remediation steps, limiting full assessment of ongoing risks.

What's next: Congressional committees are expected to investigate the breach, likely prompting stricter federal cybersecurity requirements and increased scrutiny of identity access management systems.