[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEINc0pD528xO9iywUmdtbjMmcWFMX9n29oZZuVJQxMc":3},{"article":4,"iocs":46,"watch_terms":51,"solutions":52,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"a8f448c7-7e19-42ea-96cc-749d13a85f51","Hacker leaks data on more than 40,000 Homeland Security employees","hacker-leaks-data-on-more-than-40-000-homeland-security-employees-7c270a","A hacker leaks personal data on more than 40,000 DHS employees, including CBP, ICE and CISA staff, after an undisclosed breach. Personal details of thousands of U.S. Department of Homeland Security (DHS) employees are now online after a hacker stole reams of data in a data breach that occurred earlier this year and nobody had […]","A threat actor calling themselves \"Department of Peace\" leaked personal information on over 40,000 U.S. Department of Homeland Security employees, including CBP, ICE, and CISA staff, after compromising the agency's Okta single sign-on system. The leaked database, dubbed Icepick, contains names, job titles, work emails, phone numbers, and office locations of border agents, immigration officials, cybersecurity staff, and senior DHS personnel. The actor claimed the leak was in response to government actions against ICE and stated they had access to IT records and login credentials showing which systems each employee could access.","Hacker leaks personal data of 40,000+ DHS employees after Okta SSO breach.","https:\u002F\u002Fsecurityaffairs.com\u002F202103\u002Fdata-breach\u002Fhacker-leaks-data-on-more-than-40000-homeland-security-employees.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2019\u002F01\u002FDHS-hijacking.jpg","2026-10-30T06:26:27+00:00","2026-10-30T08:00:12.748116+00:00",9,[17,20,23,25,28],{"name":18,"type":19},"Okta","vendor",{"name":21,"type":22},"Department of Peace","threat_actor",{"name":24,"type":19},"U.S. Department of Homeland Security (DHS)",{"name":26,"type":27},"Single Sign-On (SSO)","technology",{"name":29,"type":19},"DDoSecrets","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":30,"icon":32,"name":33,"slug":34},null,"Breaches","breaches",[36,41],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",[47],{"type":48,"value":49,"context":50},"malware","Icepick","Leaked database of DHS employee records; also name of the breach\u002Fdataset",[18,24,29],{"controls":53,"vendors":141},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":84,"name":85,"problem":86,"products":87},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":113,"name":114,"problem":115,"products":116},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","enterprise-security","Splunk Enterprise Security","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fenterprise-security.html","SIEM for detection, investigation and response, on premises or in the cloud.",[142],{"slug":143,"name":18,"logo_path":144,"roles":145},"okta","\u002Fvendor-logos\u002Fokta.png",[146],"affected",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":159},"dhs-okta-sso-breach-exposes-40000-employee-records","DHS Okta SSO Breach Exposes 40,000 Employee Records","A threat actor compromised DHS's Okta single sign-on system, leveraging a centralised identity platform to gain broad access to sensitive employee data across multiple agencies including CBP, ICE, and CISA. The breach highlights the double-edged nature of SSO solutions: while they improve usability, a single point of compromise can cascade into enterprise-wide exposure. The leaked data — including names, roles, contact details, and system access credentials — creates significant risks for targeted phishing, social engineering, and physical security threats against federal personnel. This incident underscores that privileged identity infrastructure must be hardened, continuously monitored, and subject to strict least-privilege controls to limit blast radius when credentials are compromised.",[152,153,154,155,156,157,158],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 6: Access Control Management","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","GDPR Article 32",{"GDPR Article 32":160,"MITRE ATT&CK T1566: Phishing":161,"NIST SP 800-53 SI-2: Flaw Remediation":162,"CIS Control 6: Access Control Management":163,"CIS Control 17: Incident Response Management":164,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":165,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":166},"While a US federal incident, the principle applies universally: organisations must implement appropriate technical and organisational measures to protect personal data, including securing the identity systems that gate access to employee records.","The leaked dataset — containing names, roles, emails, and system access details — provides a highly targeted list for future spear-phishing campaigns against DHS personnel, making this a direct enabler of follow-on phishing attacks.","If the Okta compromise exploited a known vulnerability or misconfiguration, a disciplined flaw remediation process would have identified and closed it before the attacker could leverage it.","Applying least-privilege access and regularly reviewing who can access employee data repositories via SSO would have reduced the volume of records an attacker could exfiltrate from a single identity compromise.","A tested incident response plan covering identity-platform breaches would have accelerated containment, credential rotation, and affected-employee notification to reduce ongoing harm from the leaked data.","Systematic tracking and remediation of vulnerabilities in critical identity infrastructure like Okta would have reduced the attack surface available to the threat actor.","The attack exploited the Okta SSO system; robust identity management controls including MFA enforcement and session monitoring would have limited the attacker's ability to pivot across agency systems using a single compromised identity."]