[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxTx5sx_UqsIeVbS7hNiZ42kel1yDle8I2su7Y1na2fY":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"a8fae1e9-2773-4f9c-8327-56d8ad986e51","Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents","hacktivists-leak-41-000-dhs-staff-records-revealing-undercover-ice-agents-fc010f","Names, offices, contact details and assignments of more than 41,000 U.S. Department of Homeland Security (DHS) employees have been leaked by a hacktivist group calling itself the Department of Peace. The group handed the data to the transparency collective Distributed Denial of Secrets (DDoSecrets) and to Swiss hacker and journalist maia arson crimew. DDoSecrets published the dataset, named Icepick, on October 28. According to the hacktivists, the records were taken from an Okta single sign-on … More → The post Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents appeared first on Help Net Security.","A hacktivist group named Department of Peace has leaked over 41,000 U.S. Department of Homeland Security (DHS) employee records, including names, offices, and assignments of undercover ICE agents. The data, published by Distributed Denial of Secrets (DDoSecrets) and journalist maia arson crimew, was allegedly exfiltrated from an Okta single sign-on service, though Okta denies any compromise of its systems. The leak provides extensive details that could aid in identifying DHS personnel and operations, raising significant security concerns.","Hacktivists leak 41,000 DHS employee records, including undercover ICE agents.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F29\u002Ficepick-dhs-leak-ice-undercover-agents\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002F02152933\u002Fdata_leak-1500.webp","2026-10-29T10:16:18+00:00","2026-10-29T11:00:13.933657+00:00",8,[17,20,23,25,28],{"name":18,"type":19},"Okta","vendor",{"name":21,"type":22},"Department of Peace","threat_actor",{"name":24,"type":22},"ShinyHunters",{"name":26,"type":27},"Icepick","campaign",{"name":29,"type":30},"single sign-on","product","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":31,"icon":33,"name":34,"slug":35},null,"Breaches","breaches",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"domain","icepi.cx","Website created by maia arson crimew to make DHS employee data searchable.",[18,29],{"controls":61,"vendors":141},[62,90,116],{"slug":63,"name":64,"problem":65,"products":66},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":84,"vendor_name":18,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":91,"name":92,"problem":93,"products":94},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":84,"vendor_name":18,"vendor_logo":85,"product_slug":112,"product_name":113,"url":114,"description":115},"workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":117,"name":118,"problem":119,"products":120},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[121,129,134],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"cribl","Cribl","\u002Fvendor-logos\u002Fcribl.png","cribl-stream","Cribl Stream","https:\u002F\u002Fcribl.io\u002Fproducts\u002Fstream\u002F","Collects, reduces, redacts and routes data between sources and tools, keeps a full-fidelity copy in low-cost storage, and replays it when needed.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":130,"product_name":131,"url":132,"description":133},"cribl-lake","Cribl Lake","https:\u002F\u002Fcribl.io\u002Fproducts\u002Flake\u002F","Managed data lake for IT and security telemetry in open formats, to store data cheaply and search or replay it later.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":136,"url":139,"description":140},"tenzir","Tenzir","\u002Fvendor-logos\u002Ftenzir.png","tenzir-platform","https:\u002F\u002Ftenzir.com\u002F","Pipelines that collect, shape, enrich and route security data, with an open-source core and free and commercial editions.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":154},"hacktivist-leak-exposes-41000-dhs-records-including-undercover-agent-identities","Hacktivist Leak Exposes 41,000 DHS Records Including Undercover Agent Identities","A hacktivist group allegedly exfiltrated over 41,000 DHS employee records—including sensitive details about undercover ICE agents—purportedly through a compromise related to Okta's single sign-on service. The exposure of covert personnel identities represents a severe operational security failure, as aggregating employee names, offices, and assignments can directly endanger lives and compromise ongoing law enforcement operations. This incident highlights the critical danger of centralizing sensitive personnel data behind a single identity provider without layered access controls and data segmentation. It also underscores that even if the SSO provider itself was not breached, misconfigured integrations or compromised downstream tenant accounts can be equally devastating.",[147,148,149,150,151,152,153],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 6: Access Control Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 3: Data Protection","CIS Control 13: Network Monitoring and Defense","NIST CSF 2.0 RS.MA: Incident Management",{"CIS Control 3: Data Protection":155,"NIST SP 800-53 SI-2: Flaw Remediation":156,"NIST CSF 2.0 RS.MA: Incident Management":157,"CIS Control 6: Access Control Management":158,"CIS Control 13: Network Monitoring and Defense":159,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":160,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":161},"Classifying covert agent records as highly sensitive and applying data-at-rest and data-in-transit protections—as well as strict access segmentation—would have dramatically reduced the impact of this exfiltration.","If the breach stemmed from a misconfiguration or unpatched vulnerability in the SSO tenant, a structured flaw remediation and configuration review process would have identified and corrected the exposure.","A well-rehearsed incident response plan specifically covering third-party SSO compromise scenarios would have accelerated containment, credential rotation, and public communication after the breach was discovered.","Proper role-based access controls and regular access reviews would have ensured that sensitive covert agent records were not broadly accessible through a shared SSO integration.","Continuous monitoring of data flows and bulk access events within the SSO and HR systems would have detected the large-scale record exfiltration in progress, enabling earlier containment.","Regular vulnerability and configuration assessments of SSO platform integrations would have surfaced overly permissive access grants before they could be exploited to exfiltrate sensitive personnel records.","The incident exploited weaknesses in identity and access management; enforcing strict SSO scoping, MFA, and least-privilege access policies would have limited what data an attacker could retrieve after gaining a foothold."]