Hackers expose the identities of more than 40k DHS employees
- ID
- 41055
- Status
- summarized
- Published
- 29 Oct 2026, 8:31 PM
- Fetched
- 30 Oct 2026, 1:06 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://text.npr.org/nx-s1-6021497
- Source URL
- https://hnrss.org/best
Summary
- Score
- 4.0
- Created
- 30 Oct 2026, 1:07 PM
- Tags
- Audience
- developerssaas_founders
What happened
A hacktivist group calling itself the Department of Peace says it stole DHS personnel files by subverting the department's single sign-on system, exposing names, phone numbers and addresses of more than 40,000 agents, operatives and associates, including people in undercover work. The material was passed to Distributed Denial of Secrets, which published it as a database called Icepick, and journalist Ryan Ottignon and Swiss activist maia arson crimew turned it into a searchable site (crimew did the technical work per Ottignon). The haul includes 21,000+ Customs and Border Protection records and 10,000 ICE/Homeland Security Investigations records — roughly a fifth of DHS's 220,000-strong workforce.
Why it matters
The lesson for builders is the export path, not the login: one compromised SSO layer yielded a bulk, searchable index of names, phone numbers and home addresses. If your IdP sits in front of an employee or customer directory, the fields stored alongside auth decide the blast radius — an identity store that also holds phone and address data turns a single credential compromise into a doxxing dataset. There is no Malaysian or SEA angle in this report; treat it purely as an architecture case study.
Discussion angle
Would your SSO compromise produce just session tokens, or a full directory export with personal contact fields attached? Walk through where auth data and PII get co-located in a typical SaaS stack, and what you'd separate first.