Department of Homeland Security: Massive data exfiltration of workforce and internal systems (Icepick)

A threat group calling itself the "Department of Peace" has leaked a large archive of Department of Homeland Security (DHS) records, dubbed "Icepick," containing the personal information of 41,000 employees and contractors. The leaked data includes email addresses, phone numbers, office locations, reporting hierarchies, and references to sensitive internal programs, including undercover operations, surveillance initiatives (e.g., CICTO, ISIP), and specialized access groups. The attackers claim the data originated from DHS's Okta environment. Okta has issued a statement denying any compromise of its own systems, suggesting the breach likely occurred via credential compromise or configuration issues within the DHS deployment.

Impact

The exposure provides a structural map of DHS operations, identifying individual personnel involved in undercover surveillance (e.g., "CUC" and "Keyhole" programs) and access to sensitive tools such as Palantir Falcon and PenLink. This data increases the risk of targeted impersonation, reconnaissance of DHS investigative workflows, and potential physical or digital threats to exposed undercover operatives.

Recommendation

• Perform an immediate audit of all administrative and privileged access roles within the organization's Okta or Identity Provider (IdP) environment.
• Review and rotate credentials for any service accounts or privileged users observed in external leak monitoring services that correspond to high-risk DHS or similar federal sector roles.
• Conduct an audit of external-facing system logs for patterns of anomalous authentication or mass data export from centralized identity and access management portals.
• Identify personnel with elevated access to sensitive investigative platforms and ensure Multi-Factor Authentication (MFA) is strictly enforced and verified against hardware-based security keys where possible.