Hacktivist Leak Exposes 41,000 DHS Employee Records via Alleged Okta SSO Compromise
What Happened — A hacktivist collective calling itself the “Department of Peace” released a dataset named Icepick that contains personal and assignment information for 41,191 U.S. Department of Homeland Security (DHS) employees. The data set, posted to Distributed Denial of Secrets (DDoSecrets) and made searchable through an online tool built by journalist Maia Arson Crimew, includes names, office locations, phone numbers, email addresses, and internal group memberships (e.g., Customs and Border Protection, ICE). The group alleges the records were extracted from an Okta single‑sign‑on (SSO) service used by DHS. Okta has publicly denied any breach of its systems. DHS confirmed it is “aware of a potential breach” and is actively investigating. This disclosure follows two other federal data exposures in September, highlighting a recent wave of attacks on U.S. government personnel data.
Why It Matters for Trust & Control Assurance — The incident tests an organization’s third‑party risk oversight: relying on an external identity provider without continuous assurance can expose sensitive employee data.
Who Is Affected — U.S. federal government agencies, primarily DHS and its sub‑components (Customs and Border Protection, ICE, etc.).
Recommended Actions — Review and tighten third‑party risk management for identity services; obtain recent security attestations from the IdP; enable and monitor detailed SSO access logs; update incident‑response playbooks to include supplier‑focused scenarios; consider supplemental MFA for privileged accounts.
Technical Notes — Alleged attack vector: compromise of Okta SSO credentials or configuration (third‑party dependency). Data types exposed: personally identifiable information (PII) – names, phone numbers, email addresses, job titles, internal group memberships. No CVE or vendor‑issued advisory is linked to this event. Source: Help Net Security