The DHS employee data leak: what was published, and what to do
A directory of more than 41,000 Department of Homeland Security staff, most of them at CBP and ICE, went online on 28 October 2026. It holds names, offices and contact details rather than Social Security numbers. The danger is what those details unlock on people-search sites, and that part you can fix.
On 28 October 2026 DDoSecrets published a searchable directory of 41,191 DHS employees and contractors, supplied by a group calling itself the Department of Peace. Most records belong to CBP and ICE staff and include names, offices, assignments, contact details and internal group memberships. The group says the data came from an Okta sign-in service; Okta denies being compromised, and DHS calls it a potential breach. No Social Security numbers have been reported and no notification has been announced. Staff should follow agency guidance, lock down their phone number and accounts, and remove their home address and their family’s from people-search sites.
What DHS and Okta say vs what has been reported
The middle column is what DHS and Okta have said on the record. The right column is what the publishers claim and what reporters found in the data. Where nobody has said anything, the row says so.
| Question | DHS / Okta | Reported |
|---|---|---|
| That something happened | A DHS spokesperson told the BBC the department is aware of a potential breach and is working to address it, and that it will update the public when it knows more. | A group calling itself the Department of Peace handed the records to the transparency collective DDoSecrets, which published them as a searchable dataset on 28 October 2026. |
| How many people | No figure from DHS. | The searchable index lists 41,191 people and 55,603 internal groups. Help Net Security counted about 21,300 CBP and 6,600 ICE records; WIRED’s analysis found CBP staff make up more than half of the set. Some outlets round to “40,000+”. |
| What is in a record | Not described. | Names, offices, work assignments and contact details, plus membership of internal groups. Reporters say some groups point to sensitive roles, such as certified undercover agents or use-of-force instructors. |
| Where it came from | Okta told Reuters it is secure and has no evidence its data or systems were compromised. DHS has not named a source. | The publishers say the data came from an Okta single sign-on service DHS uses. That claim has not been verified independently. |
| Whether it is accurate | DHS has not commented on accuracy. | Reuters matched six named employees against credit-bureau and breach records and reached three by phone. The site itself says the list is incomplete and may repeat errors from its source. |
| Home addresses and Social Security numbers | Not addressed. | Not reported as part of the published fields. That matters less than it sounds, because a name plus an agency is enough to look up a home address on people-search sites. |
| Notification and credit monitoring | None announced as of 5 November 2026. | Nothing published so far describes letters to employees or an identity-protection offer. |
| Whether the public’s data is in it | Not addressed. | Everything reported describes a staff and contractor directory. No traveler, immigration-case or other public records have been reported in the set. |
Sources: reporting by Reuters, The Washington Post, NPR, the BBC, WIRED and Help Net Security, 28–29 October 2026. Status as of 5 November 2026. We will update this page if DHS publishes an assessment or starts notifying staff.
1. What happened, in order
On 28 October 2026 DDoSecrets published a dataset it calls Icepick: a searchable directory of more than 41,000 Department of Homeland Security employees and contractors. The records were supplied by a group calling itself the Department of Peace, which says it took them from an Okta single sign-on service DHS uses. Reuters, The Washington Post, NPR, the BBC and WIRED covered it the same day and the next. Okta denied any compromise of its systems. DHS told the BBC it is aware of a potential breach and is working to address it. Since then the department has not published a count, a list of affected fields or any notification plan.
2. Who is in it
Mostly U.S. Customs and Border Protection and Immigration and Customs Enforcement. Help Net Security counted about 21,300 CBP records and 6,600 for ICE in the searchable index, and WIRED found CBP alone is more than half of the set. Other components appear in smaller numbers, and the site excludes CISA staff from default searches. The operators admit the list is not complete and may repeat errors from their source, so someone missing from it cannot assume they were left out, and someone listed may have outdated details. This is a staff directory. Nothing reported so far involves travelers, immigration cases or other records about the public.
3. Why a work directory is enough to cause trouble
Names, offices and work contact details sound mild next to a Social Security number leak. The problem is what they connect to. Reuters checked six named employees against credit-bureau and breach records and found matches, then called three of them on numbers from the data. Anyone can do the same thing with a people-search site: type a name and a city, and the result usually shows a home address, a personal phone number, an age and a list of relatives. The leak supplies the name and the employer. Brokers supply everything else. That is why this is a doxxing risk, and why the useful response is mostly about the broker side.
4. You cannot check this in a breach database
The dataset is a directory, not a list of email addresses and passwords, so it will not show up in the known breach databases that checking tools search. Ours cannot tell you whether you are in it either. If you want to know, ask your agency’s security office. What a breach check can answer is the other half: which older breaches your personal email has turned up in, which is how attackers find a password to try against a work account. Run that with our free breach check.
5. The phishing and calls that come next
A list of names, roles and contact details is what a targeted phishing campaign is built from. Expect emails that imitate an Okta or DHS sign-in reset, texts claiming to be from your agency’s IT desk, and calls from people who already know your office and supervisor. Some will pretend to be journalists, lawyers or a “breach response” team offering to check whether you are listed. Do not click links or confirm details to anyone who contacted you first. Sign in the way you always do, and send the message to your security office. Our guide to breach notification letters shows what a genuine notice looks like if DHS sends one.
6. What to do this week if you work at DHS
Follow your agency’s instructions first; this list is for everything outside work systems. Put a port-out PIN or number lock on your personal mobile account so nobody can move your number to a new SIM. Turn on two-factor authentication on your personal email and change any password you reuse. Freeze your credit at Equifax, Experian and TransUnion, which is free and stops new accounts in your name. Make social media profiles private and remove posts that show your home, your car or your children’s school. Then deal with the listings that publish your address, which is the next section. If you receive a threat, report it to your agency and to local police right away. The general checklist is in our post-breach guide.
7. Get your address off people-search sites, and your family’s too
This is the step that does the most for physical safety. People-search and data-broker sites publish home addresses, phone numbers and relatives for most adults in the U.S., and most of them have an opt-out form. Removing yourself from the big ones takes an afternoon. The catch is the relatives section. A spouse’s or parent’s listing often shows the same address, so remove theirs as well, and check again after a few weeks because brokers refresh their data from public records. Our step-by-step guide to removing your home address covers the main sites.
The leak has your name. Brokers have your address.
A work directory only becomes a home address through people-search sites. PersProtect finds where you and your household are listed and files the removal requests for you. The scan is free.
Check my exposure — free →The DHS data leak, answered
What was leaked in the DHS data breach?
A directory of more than 41,000 Department of Homeland Security employees and contractors, published on 28 October 2026. Reporting describes names, offices, assignments and contact details, plus internal group memberships that can reveal sensitive roles. CBP and ICE staff make up most of it. DHS has called it a potential breach and has not published its own description of what was taken.
Does the DHS leak include home addresses?
Home addresses have not been reported among the published fields. The risk is that they do not need to be. With a full name and an employer, anyone can pull a current home address, phone number and the names of relatives from people-search sites in a few minutes, and Reuters verified records in the leak against credit-bureau and breach data in much the same way. Taking your listings off those sites is the step that cuts the leak off from your front door.
Was Okta hacked?
Okta says no. The group behind the leak claims the records came from an Okta single sign-on service used by DHS, and Okta told Reuters it is secure and has no evidence its data or systems were compromised. Nobody has published evidence settling it either way. For an employee, the practical effect is the same: expect phishing that pretends to be an Okta or DHS sign-in reset.
I work for DHS. How do I know if I am in the leak?
Go through your agency, not the leak. Your component’s security office is the right place to ask, and it is also where to report anything suspicious that arrives because of this. Searching the published dataset yourself does not make you safer and puts your own lookup on someone else’s server. Since the site says the list is incomplete, it is sensible to act as if you are in it if you work for CBP, ICE or another listed component.
Will DHS offer credit monitoring?
Nothing has been announced. Federal agencies have offered identity protection after past personnel-record breaches, but those involved Social Security numbers, and none have been reported here. You do not have to wait for an offer: a credit freeze at Equifax, Experian and TransUnion is free, takes about ten minutes per bureau and stops new accounts being opened in your name.
My spouse or parent works for ICE or CBP. Are we at risk too?
Family members are not named in the leak as reported, but people-search sites list relatives alongside each person, often with their addresses and phone numbers. That is how a work record turns into a list of a family’s homes. Removing the employee’s listings helps less if a parent’s or adult child’s page still shows the same address, so it is worth doing for the whole household.
Is this the same as the ICE List leak earlier in 2026?
No. In January 2026 a separate site published the names of roughly 4,500 Border Patrol and ICE employees, reportedly from a whistleblower. The October 2026 dataset is about nine times larger, covers DHS more widely and came from a different group. Someone in both is not in a worse position for that, but it does mean the information has been circulating for longer than this news cycle.
Someone emailed me about the DHS breach asking me to reset my password. Is it real?
Assume it is phishing. A leak of work contact details and job roles is exactly what a targeted email needs, and a password reset or an “identity verification” link is the most common way to use it. Do not click. Sign in to your agency systems the way you normally do and report the message to your security office, which can block it for colleagues too.
You cannot pull the directory back. You can close the gap to your door.
See which people-search sites list your address, phone number and relatives. Free, in about a minute.
Run my free exposure scan →