41,194 records · 41,192 unique email addresses · 9 DHS components · 0 passwords. Icepick is a copy of the Okta user directory behind DHS single sign-on, released by Distributed Denial of Secrets on October 28, 2026. LeakedSource has verified and indexed it. Below is our breakdown of what is inside.
Breach at a glance
| Field | Detail |
|---|---|
| Breach name | Icepick |
| Organization | U.S. Department of Homeland Security |
| Domain | dhs.gov (plus component subdomains and associates.*.dhs.gov) |
| Source system | Okta single sign-on user directory |
| Data exported | Mid-August 2026 (from file timestamps in the archive) |
| Publicly released | October 28, 2026 |
| Released by | Distributed Denial of Secrets, from the hacktivist group "Department of Peace" |
| Records | 41,194 |
| Unique email addresses | 41,192 |
| Passwords | None (placeholder values only) |
| Breach type | Directory / personnel database |
| Sensitivity | High: government and law-enforcement personnel |
Records by agency
CBP makes up 51.8% of the dataset. Three immigration and border agencies (CBP, ICE and USCIS) together account for 83%.
| Component | Records | Share | Email domains |
|---|---|---|---|
| CBP | 21,329 | 51.8% | cbp.dhs.gov, associates.cbp.dhs.gov |
| ICE | 6,598 | 16.0% | ice.dhs.gov, associates.ice.dhs.gov |
| USCIS | 6,247 | 15.2% | uscis.dhs.gov |
| HSI | 3,422 | 8.3% | hsi.dhs.gov, associates.hsi.dhs.gov |
| DHS HQ | 1,755 | 4.3% | hq.dhs.gov, associates.hq.dhs.gov |
| CISA | 980 | 2.4% | cisa.dhs.gov, associates.cisa.dhs.gov |
| FPS | 394 | 1.0% | fps.dhs.gov, associates.fps.dhs.gov |
| FLETC | 337 | 0.8% | fletc.dhs.gov, associates.fletc.dhs.gov |
| S&T | 132 | 0.3% | st.dhs.gov |
4,388 records (10.7%) use an associates.* address, which typically marks contractors and other non-employee staff.
Data fields
Every record carries a name, a work email and a username. Phone numbers and office addresses are present for most people.
| Field | Records with a value |
|---|---|
| Full name (first, last) | 100% |
| Work email | 100% |
| Username | 100% |
| Secondary email | 99% |
| Job title | 99% |
| Department | 99% |
| Middle name | 76% |
| Office phone | 86% |
| Mobile phone | 66% |
| Street address | 95% |
| City / state / ZIP | 93–96% |
| Office name | 81% |
| Last sign-in date | 8% |
The raw archive also holds Active Directory group memberships, manager links, Department of Defense ID numbers (EDIPI) and Windows security identifiers. LeakedSource does not index those fields. They map the organization rather than identify a person, and are not needed to check whether you were exposed.
Account profile
This is a live directory, not an old archive: 72% of accounts were active at export, and 1 in 5 was created in 2025 or 2026. The remaining 28% were in Okta's "provisioned" state, created but not yet activated by the user. One account was suspended and one had an expired password.
| Account created | Share of records |
|---|---|
| 2022 | 68.8% |
| 2023 | 6.5% |
| 2024 | 5.0% |
| 2025 | 12.4% |
| 2026 (to August) | 7.2% |
The 2022 spike is consistent with DHS moving these users onto Okta in bulk that year.
Verification
We rate Icepick as authentic with high confidence, based on four checks run against the full archive:
- Structure. All 41,194 person records are Okta user-profile exports sharing the same attribute set. Three carry extra API response wrappers, consistent with a scripted export. Fabricated data is rarely this uniform.
- Internal consistency. Email-domain totals line up exactly with the agency folders the records were filed under, and the associates.* addresses add up exactly to the records in the associates folders.
- Counts. Our per-agency totals match the counts the leakers published with the archive, record for record.
- No padding. Only 2 email addresses repeat across 41,194 records. Recycled or merged lists usually show far more overlap.
LeakedSource has not independently confirmed the data with DHS.
Is your data in Icepick?
Search your email address on LeakedSource. A match means your name, work contact details and office location are in circulation, not your password.
If you get a hit:
- Expect pretexting. Leaked titles and reporting context make fake "colleague" or "IT support" messages far more believable. Verify any unexpected request through a known channel.
- Protect the phone number. Add a carrier port-out PIN, and stop using SMS codes on personal accounts where an app or security key is available.
- Tell your security office. Your agency or employer's security team will want to know, and may have specific guidance.
There is nothing to reset: no credentials were in this dataset. The exposure is your identity and role, so the defense is skepticism toward anyone who contacts you about them.
Sources
- Icepick — Distributed Denial of Secrets, release announcement, October 28, 2026
- LeakedSource analysis of the published archive (all figures above unless noted)