A threat actor using the handle Department of Peace has published a database holding the personal and work details of more than 41,000 employees at the U.S. Department of Homeland Security.
As SecurityWeek reported on October 29, 2026, the records cover staff at U.S. Customs and Border Protection, Immigration and Customs Enforcement and Homeland Security Investigations, along with roughly 1,000 employees of CISA and personnel at several other DHS agencies. The file carries names, work email addresses, phone numbers, job titles and office locations.
It carries a second thing as well: for every account, a list of the internal systems and applications that person is allowed to open. A searchable copy of the data is online.
The actor says the data came from an Okta single sign-on system – the login a person uses once to reach many connected apps – that DHS employees and contractors use to reach a central environment. That origin is the actor’s claim. Neither DHS nor Okta has confirmed it.
“We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised.” An Okta spokesperson gave that statement to SecurityWeek.
The release itself came with a note from the actor: “They have our information, so it’s only fair that we have theirs.”
DHS did not dispute the report: “DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.” A DHS spokesperson gave that statement to SecurityWeek, which added it after publication.
What the permission list is worth
Names and phone numbers are the part readers recognize. The permission list is the part that draws the expert warning.
Distributed Denial of Secrets obtained a copy of the database and calls it Icepick; the group says it identifies officials in charge of covert and undercover operations and key personnel in DHS’s rendition and deportation programs.
“The most concerning part of this breach is the access information that came with it. If an attacker knows which employees have access to which systems and applications, they’ve essentially been handed a roadmap for where to go next and who to target to get there.”
That is Gary Barlet, public sector CTO at Illumio.
The harm here is not only in who these people are. It is in what each of them can open, and how quickly that chart narrows the search. Every large organization runs on that permission list, whether or not anyone reads it.
Forkast has traced both ends of this before: logins built for humans in The Login That Lies, and the standards now forming around machine identities in Okta’s agent identity framework.
SecurityWeek places the leak one month after ShinyHunters breached FBI systems and three months after the Homeland Security Information Network was hacked. What travels out of a leak like this is not only personal data. It is the chart of who can open what.