INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Department of Homeland Security suffers severe staff exposure breach

| 2026-10-30 10:41 CRITICAL HIGH DATA BREACH
JSON
Executive Summary
AI-generated
A severe operational failure occurred on October 30, 2026, when more than 40,000 employees at the Department of Homeland Security (DHS) had their personal data leaked online. The breach was attributed to a hacktivist group dubbed "Department of Peace" which gained access through an Identity and Access Management platform Okta using exposed user credentials. This compromised identity allowed attackers to reach personnel records of tens of thousands of people, including job titles, contact details for those working in surveillance and undercover roles, posing a real-world safety risk. The leaked data was distributed online by transparency collective Distributed Denial of Secrets under the database codenamed "Icepick". As a result, government workers are now at risk from follow-on phishing and impersonation campaigns that may continue for months afterwards.
Technical Mitigations AI-generated
• Patch Okta IAM platform to address the vulnerability exploited by the attackers. • Implement multi-factor authentication for all employees using Okta, and monitor for suspicious login activity. • Block or hunt for phishing campaigns targeting DHS agents based on leaked job titles and contact details.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters
Target & Sectors
NORTH_AMERICA NORTH_AMERICA governmentgovernment
Incident Timeline
‎2026/10/30
Threat actors exploited a website vulnerability to sign up users and offer them free reports, exposing the contact information of approximately 40,000 staff from '2026 Future Focus'.
general_metric 2026 Future Focus
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
‎2026/10/30
Government workers in the crosshairs The DHS data leak comes just weeks after a similar incident involving the Federal Bureau of Investigation (FBI).
organisation Google News
FOLLOW US ON SOCIAL MEDIA Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
organisation Department of Homeland Security
40,000 staff exposed in 'severe' Department of Homeland Security breach.
organisation the ‘Department of Peace
A hacktivist group dubbed the ‘Department of Peace’ published the information on agents, which was then distributed online by transparency collective Distributed Denial of Secrets under a database codenamed ‘ Icepick ’.
organisation the Immigration and Customs Enforcement
As the database name suggests, a significant portion of employees exposed in the incident work for the Immigration and Customs Enforcement (ICE) and Customs and Border Protection agencies.
organisation Customs
As the database name suggests, a significant portion of employees exposed in the incident work for the Immigration and Customs Enforcement (ICE) and Customs and Border Protection agencies.
organisation DHS
In a statement, the DHS said it is “aware of a potential breach and is actively working to address the situation swiftly and effectively”.
organisation Huntress
Dray Agha, senior manager for tactical response at cybersecurity firm Huntress, said the incident is “a severe operational failure that places the physical safety of undercover personnel at direct risk”.
organisation Identity and Access Management
Compromised identity behind DHS breach The hacktivist group behind the attack claims it gained access to DHS systems through Identity and Access Management (IAM) platform Okta, using exposed user credentials.
organisation IAM
Compromised identity behind DHS breach The hacktivist group behind the attack claims it gained access to DHS systems through Identity and Access Management (IAM) platform Okta, using exposed user credentials.
organisation Check Point
" Graeme Stewart, head of public sector at Check Point, said the incident is a “stark reminder that identity is now the front door for attackers”.
threat_actor ShinyHunters
As ITPro reported in September , the ShinyHunters threat group claimed responsibility for a breach at the law enforcement agency, stealing information on thousands of agents.
organisation BlueSky
You can also follow ITPro on LinkedIn , X , Facebook , and BlueSky .
Intelligence Sources
IT Pro 2026-10-30