{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/okta-dhs-instance/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Department of Peace"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Okta (DHS instance)"],"_cs_severities":["high"],"_cs_tags":["data-leak","identity-compromise","exfiltration","federal"],"_cs_type":"threat","_cs_vendors":["Department of Homeland Security"],"content_html":"\u003cp\u003eA threat group calling itself the \u0026quot;Department of Peace\u0026quot; has leaked a large archive of Department of Homeland Security (DHS) records, dubbed \u0026quot;Icepick,\u0026quot; containing the personal information of 41,000 employees and contractors. The leaked data includes email addresses, phone numbers, office locations, reporting hierarchies, and references to sensitive internal programs, including undercover operations, surveillance initiatives (e.g., CICTO, ISIP), and specialized access groups. The attackers claim the data originated from DHS's Okta environment. Okta has issued a statement denying any compromise of its own systems, suggesting the breach likely occurred via credential compromise or configuration issues within the DHS deployment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe exposure provides a structural map of DHS operations, identifying individual personnel involved in undercover surveillance (e.g., \u0026quot;CUC\u0026quot; and \u0026quot;Keyhole\u0026quot; programs) and access to sensitive tools such as Palantir Falcon and PenLink. This data increases the risk of targeted impersonation, reconnaissance of DHS investigative workflows, and potential physical or digital threats to exposed undercover operatives.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePerform an immediate audit of all administrative and privileged access roles within the organization's Okta or Identity Provider (IdP) environment.\u003c/li\u003e\n\u003cli\u003eReview and rotate credentials for any service accounts or privileged users observed in external leak monitoring services that correspond to high-risk DHS or similar federal sector roles.\u003c/li\u003e\n\u003cli\u003eConduct an audit of external-facing system logs for patterns of anomalous authentication or mass data export from centralized identity and access management portals.\u003c/li\u003e\n\u003cli\u003eIdentify personnel with elevated access to sensitive investigative platforms and ensure Multi-Factor Authentication (MFA) is strictly enforced and verified against hardware-based security keys where possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T13:47:01Z","date_published":"2026-10-29T13:47:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-dhs-leak/","summary":"An entity identifying as the 'Department of Peace' exfiltrated and leaked sensitive DHS records involving 41,000 personnel and internal system configurations, reportedly obtained via the DHS Okta login portal.","title":"Department of Homeland Security: Massive data exfiltration of workforce and internal systems (Icepick)","url":"https://feed.craftedsignal.io/briefs/2026-10-dhs-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - Okta (DHS Instance)","version":"https://jsonfeed.org/version/1.1"}