Hacker breaches DHS through Okta, exposing 41,000 ICE, CBP, and CISA employee records

A hacker stole personal records on more than 41,000 Department of Homeland Security employees by breaching Okta, the identity and access management service DHS uses to authenticate staff, as first reported by TechCrunch and Wired and confirmed by The Verge. The exposed data includes names, job titles, phone numbers, email addresses, and office locations for roughly 21,000 Customs and Border Protection employees and nearly 7,000 Immigration and Customs Enforcement staff, along with personnel from the Cybersecurity and Infrastructure Security Agency, US Citizenship and Immigration Services, and Homeland Security Investigations.

The breach matters beyond its size because of who it targets and what else it reveals. DHS has spent the past year actively working to conceal the identities of CBP and ICE agents — officers have worn masks during immigration raids specifically to avoid identification — while the agency has simultaneously pursued its own critics online. A hacker using the handle "Department of Peace" framed the leak as a direct response to that asymmetry: "They have our information, so it's only fair that we have theirs," the hacker told TechCrunch. The breach also reportedly exposed details about DHS units with access to surveillance tools, including the Mobile Fortify facial-recognition app and PenLink, a system that collects and analyzes data from phones and online services.

According to the reporting, the stolen data was passed to security researcher maia arson crimew, who shared it with Distributed Denial of Secrets, a nonprofit transparency organization now hosting the material as a dataset called "Icepick." Bluesky has since begun blocking links to the DDoSecrets archive, telling Wired it enforces strict policies against sharing personal information such as email addresses and phone numbers without authorization, regardless of the newsworthiness of the underlying leak.

The incident is the second major breach of a federal law-enforcement workforce in recent weeks: it follows a separate hack that exposed FBI employee and job-applicant data, reported by The Verge in October. Both breaches point to the same structural risk — a single compromised identity provider or HR system can expose an entire agency's workforce roster at once, including personnel whose safety depends on anonymity. DHS did not immediately respond to a request for comment on the breach or on how the Okta compromise occurred.