Hackers Leak Database of 42,000 DHS Employees
The breach exposes names, contact details, and undercover assignments for agency personnel.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Is the public disclosure of government agent identities justifiable in the pursuit of institutional accountability?
Hackers have leaked a Department of Homeland Security database containing the personal information of 42,000 employees. The breach includes a publicly accessible search tool at icepi.cx that exposes identities and assignments for agents at ICE and CBP.
Why it matters
The compromise of federal employee data through an Okta single sign-on service highlights critical vulnerabilities in the identity management systems securing government personnel information. This breach potentially exposes agents involved in sensitive, non-public operations.
The leaked dataset covers 42,000 personnel, roughly one-fifth of the agency's total workforce. Access was gained by compromising an Okta single sign-on service, a centralized authentication protocol used to manage user access across cloud applications.
The players
Department of Homeland Security
A cabinet-level U.S. department responsible for public security, border control, and intelligence.
DDoSecrets
A transparency collective that hosts leaked datasets and provides tools for public searching.
Okta
A San Francisco-based provider of cloud-based identity and access management software.
Markwayne Mullin
The Secretary tasked with managing immigration enforcement operations.
The details
The breach was executed by compromising an Okta single sign-on service—a centralized identity provider that allows users to access multiple applications with one set of credentials—used by the Department of Homeland Security. This provided access to a dataset containing names, phone numbers, emails, and job assignments. The hackers subsequently published these records via a search tool on icepi.cx that allows filtering by name, agency, title, and location. The records include specific markers for personnel assigned to undercover, covert, and special counter-intelligence operations.
Timeline
January 2026: CBP agents were involved in a fatal shooting of a protester in Minneapolis.
July 17, 2026: Secretary Markwayne Mullin promised to intensify immigration enforcement.
October 28, 2026: The data breach was publicly reported.
The Tech Race
This incident follows the precedent set by the 2015 Office of Personnel Management data breach in exposing the susceptibility of federal infrastructure to identity-focused cyberattacks. The use of a compromised identity provider highlights the ongoing struggle to secure single sign-on services against targeted infiltration.
Federal employees at ICE and CBP may face increased risks of targeted harassment due to the exposure of their personal contact details. The tool allows the public to identify specific agents involved in sensitive operations, potentially compromising active undercover assignments.
The takeaway
The compromise highlights the significant security risks associated with centralized identity providers when access is inadequately protected. Observers should track federal updates regarding potential multi-factor authentication mandates or forensic audits of agency SSO configurations.
Further reading
For broader trends in federal system security, explore the latest updates in Cybersecurity.
More information
View the current status of the exposed data on the DHS employee data search tool.
Live Poll
Is the public disclosure of government agent identities justifiable in the pursuit of institutional accountability?
