Leak Exposes 41,000 Homeland Security Workers–Including Undercover ICE Agents
- ID
- 40672
- Status
- summarized
- Published
- 29 Oct 2026, 5:03 AM
- Fetched
- 29 Oct 2026, 11:35 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 3.0
- Created
- 29 Oct 2026, 11:35 AM
- Tags
- Audience
- developers
What happened
Distributed Denial of Secrets published a 41,000-record archive called "Icepick" covering DHS staff and contractors across the department and seven component agencies including ICE and CBP, with data last updated August 19, 2026. Records include emails, phone numbers, office addresses, facility locations, and references to internal systems and surveillance programs. DDoSecrets says the data came from DHS's Okta login system, while an Okta spokesperson told WIRED the company has no evidence its systems or data were compromised; researcher maia arson crimew built a searchable site for the records, and the leak follows a ShinyHunters claim of stealing data on nearly every FBI employee.
Why it matters
The disputed detail is the claimed Okta origin: if you run workforce SSO on Okta, the only actionable item here is checking whether your tenant logs show bulk directory export or enumeration of tens of thousands of profiles, since Okta's denial means the actual source is unconfirmed. For most Malaysian builders this is a read-only story — no patch, no config change, no pricing or API impact — so treat it as context on identity-data exposure, not a to-do.
Discussion angle
Okta says it's secure, DDoSecrets says the data came from DHS's Okta system — what would bulk export of 41,000 identity records actually look like in Okta system logs, and is that detection something small teams realistically have turned on?