The DHS employee data leak: 41,000 records out, and “what happened?” is still the open question

On October 28, 2026, the transparency group Distributed Denial of Secrets (DDoSecrets) published a searchable database called “Icepick” covering more than 41,000 current and former DHS employees and contractors, according to public reporting from Nextgov/FCW, CyberScoop, and The Washington Post. TechCrunch counted about 21,000 records from Customs and Border Protection, about 10,000 from Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations unit, just under 1,000 from the Cybersecurity and Infrastructure Security Agency, and thousands more from other DHS components.

The records include names, job titles, work email addresses, work cell numbers, office locations, and internal group memberships, which show what teams and internal applications each person belongs to. Fox News and NBC News reported that some officers are marked as undercover. DDoSecrets says the set contains no home addresses. TechCrunch, Nextgov/FCW, CyberScoop, and Reuters each matched a sample of records to real employees, and none has verified the whole collection. Some records are years old.

Very little has been confirmed. The self-described hacktivist group behind the leak, which calls itself “Department of Peace,” claims it pulled the data from the Okta single sign-on service DHS uses to let staff sign in to its applications. Okta told TechCrunch, Nextgov/FCW, and CyberScoop it has “no evidence our data or systems were compromised,” and Reuters reported it could not corroborate the claim. No outlet has reported whether the access came from a stolen credential, an API token, an insider, or a misconfiguration.

The timeline is just as unsettled. TechCrunch reports that timestamps on the records suggest the data was taken around mid-August, roughly ten weeks before it surfaced. DHS said it is “aware of a potential breach” and working to address it. The Washington Post and Reuters both reached employees who had not been told and learned about the leak from reporters. The same group claimed a March 2026 leak of DHS contract data, according to TechCrunch.

This could happen at nearly any organization, and the hard part starts once someone suspects a breach. The questions are simple to ask. Which account read the data? How much did it read, when did it start, and from which device or address? Is it still happening? Each answer drives a decision: whose credentials to revoke, which people to warn, what to tell leadership, and whether a breach notice is required.

When the system holding the data already keeps a complete record of who read what, those answers come from a search. When it does not, investigators reconstruct events from scattered sign-in logs, partial application logs, and vendor support tickets, and that work routinely takes days or weeks. Until it is done, the people affected have no answer, and the attacker’s description of the breach is the only one in public. In this case, the people affected include officers whose undercover status is now exposed.

Scoping delays show up across government breaches this year. When the Pentagon notified people affected by its Defense Manpower Data Center breach, the scope was still written in terms of what attackers “may” have accessed. RackTop tracks these patterns in its running list of government data breaches in 2026.

By the group’s own account, the DHS data came from an identity service, not a file share, and RackTop BrickStor SP does not sit in front of a single sign-on service. But personnel rosters, HR exports, org charts, badge lists, and case files sit on file storage at most agencies and companies, and a bulk read of tens of thousands of records looks the same there. For that data, the record and the defense can live in the storage system itself.

BrickStor SP’s User Behavior Auditing records every file read, write, rename, and delete by user, session, and client in an immutable audit trail inside the storage operating system, where an intruder cannot switch it off or edit it. When a breach is suspected, an investigator filters that record by account and time window and gets the list of files the account read, when, and from which client, without assembling logs from other systems. The record can also stream to a security information and event management (SIEM) platform for correlation with sign-in data. The example UB report below shows what that view looks like.

Active Defense watches the same activity live across SMB, NFS, S3, and Web Drive and terminates a session that starts reading files in bulk in under a second, so the record shows an attempt that was stopped rather than a full copy. Attribute-based access control (ABAC) limits what any one account can reach in the first place, which keeps the blast radius of a stolen credential small. Together they are what Cyberstorage means in practice: data storage security that can detect, stop, and explain an incident from the place the data lives.

Pick a sensitive dataset, such as a personnel roster, and ask your team to say, from records you already keep, which accounts read it in the past 30 days and how much each read. Time how long that takes. Check how long those records are retained and whether an administrator could delete them. Then decide in advance who gets told, and how fast, when the answer looks wrong.

If that exercise takes longer than an afternoon, RackTop’s free Cyber Recovery Readiness Assessment is a useful next step: 32 scored questions on how ready you are to detect, scope, and recover from data theft, ransomware, and insider misuse. You can also request a demo to see a live UB report on BrickStor SP and watch Active Defense stop a bulk read as it happens.