Hacktivist Group “Department of Peace” Leaks 41,000 DHS Employee Records via Compromised Okta SSO
What Happened — Hacktivists identifying themselves as the “Department of Peace” obtained a database from an Okta single‑sign‑on (SSO) tenant used by the U.S. Department of Homeland Security (DHS). The dump, dubbed “Icepick,” contains personal and assignment details for more than 41,000 DHS employees, including agents from Customs and Border Protection, Immigration and Customs Enforcement, the Cybersecurity and Infrastructure Security Agency, and other DHS components. The data (≈165 MB) was posted publicly through Distributed Denial of Secrets and is searchable via an online tool hosted at Icepi.cx. DHS confirmed the breach, stating it is investigating and working to remediate the exposure.
Why It Matters for Trust & Control Assurance — The incident highlights the need for robust identity‑and‑access‑management controls and continuous monitoring of third‑party authentication services.
Who Is Affected — Federal government agencies (DHS and its sub‑components).
Recommended Actions —
- Review and harden Okta tenant configurations, especially privileged account protections and session policies.
- Implement continuous monitoring of authentication logs for anomalous access patterns and enforce multi‑factor authentication for all privileged users.
Technical Notes — The leak appears to stem from unauthorized access to the Okta tenant rather than a disclosed vulnerability; no CVE is referenced. Exposed data includes employee names, office locations, contact information, and operational assignments. Source: DataBreachToday