> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Department of Peace leaks DHS employee data via Okta SSO compromise
- URL: https://f4n6.co.uk/security-feed/department-of-peace-leaks-dhs-employee-data-via-okta-sso-compromise/
- Published: 2026-10-30T15:06:48.000Z
- Updated: 2026-10-30T15:06:48.000Z
- Author: Jeff Davies
- Tags: #security-feed, Department of Peace, maia arson crimew, DDoSecrets

## 1\. Executive summary

A group calling itself Department of Peace says it used a US Department of Homeland Security single sign-on account, provided through Okta, to reach internal data and has published records covering more than 41,000 DHS staff under the name "Icepick". The dataset includes names, work email addresses, phone numbers, office addresses, job titles and Active Directory group memberships for staff at nearly 7,000 offices, among them almost 6,600 ICE employees, over 21,000 CBP employees and personnel at CISA. Okta states it has no evidence its own data or systems were compromised, which leaves abuse of a DHS account with stolen credentials as the working explanation; DHS says it is aware of a potential breach. No CVE, CVSS score or CISA KEV entry applies to this item, and no MITRE ATT&CK profile exists for Department of Peace, maia arson crimew or DDoSecrets, so the attribution is unconfirmed. For EMEA financial services the direct exposure is limited, but the mechanism matters: a single SSO identity gave access to directory group data that maps who can reach which internal and third-party tools, and that is the same asset class a bank's own identity provider holds.

## 2\. Regulatory framing

| Article                                                        | Trigger (the fact in this item)                                                                                                                                                             | Practical impact                                                                                                                                                                           |
| -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| DORA Art. 28: ICT third-party risk, general principles         | The claimed access path runs through Okta, an external identity provider, and the leaked group data names third-party tools (Mobile Fortify, Penlink) reachable through that identity layer | Firms must be able to evidence that identity-provider and SSO dependencies are inside the third-party register, with the access they grant to internal and third-party services documented |
| DORA Art. 29: preliminary assessment of ICT concentration risk | A single SSO provider sits in front of many workplace services, so one compromised identity reaches all of them                                                                             | Where Okta or a comparable IdP fronts multiple critical or important functions, the concentration assessment must record that shared dependency and the blast radius of one identity       |
| NIS2 Art. 21(2)(d): supply chain security measures             | The incident turns on the security posture of an external identity provider and the third-party services its groups unlock                                                                  | Essential and important entities must hold supply chain measures covering identity providers, including what group and entitlement data the provider and connected services expose         |

## 3\. Technical analysis & attack chain

Confirmed steps, as stated by the publishers and reported by Malwarebytes:

1. Department of Peace obtained access to DHS information through a single sign-on service provided by Okta, according to the group's own claim.
2. The group extracted records covering more than 41,000 DHS staff across nearly 7,000 offices, with timestamps suggesting the data was taken around mid-August.
3. The data was passed to maia arson crimew, who published it with DDoSecrets under the name "Icepick".
4. DHS acknowledged a potential breach. Okta said it has no evidence its data or systems were compromised.

The group linked the attack to a 17 July statement by DHS Secretary Markwayne Mullin promising to "turn up the heat" with traffic stops. It also claimed theft of DHS contract documents in March.

What the data contains. Names, work email addresses, phone numbers, office addresses, job titles and membership of internal DHS groups. The headcount breakdown is almost 6,600 ICE employees, over 21,000 CBP employees, and an unspecified number of CISA staff. Job titles identify agents in special operations, surveillance and undercover roles, per the Guardian.

The directory exposure is the part that matters technically. The leaked group memberships come from Active Directory, which governs access to internal tools, services and third-party software. Over 200 CBP users sat in a group with access to the facial recognition tool Mobile Fortify. Other groups reference Penlink, a service the vendor says can track location data of hundreds of millions of mobile devices. In an SSO estate, group membership is the authorisation layer: it tells an attacker which identities unlock which applications, and it is exactly the data an adversary needs to plan targeted phishing or credential reuse against named individuals and the tools they can reach.

Mechanism and confidence. The SSO route is the group's claim, not a confirmed forensic finding. Okta's denial of compromise to its own systems is consistent with credential theft or session abuse against a DHS account rather than a provider-side breach, but nothing in the source establishes how the credentials were obtained, whether MFA was bypassed, or which Okta tenant configuration was involved. Treat the initial access vector as unconfirmed. The publication chain (Department of Peace to crimew to DDoSecrets) and the dataset contents are reported by Malwarebytes drawing on TechCrunch, Reuters and the Guardian; the headcount figures are single-sourced to that reporting and should be verified before use in any client communication.

Secondary risk. Reuters matched six DHS employees' records to credit bureau data and dark web breach data, showing that even work contact details can be cross-referenced to home and financial identity. A separate searchable version of the data was augmented with automated and manual research, so some entries in that version did not come from DHS. DHS has warned of harassment, stalking and physical harm; no specific threats or operational impact are confirmed.

## 4\. Mitigation & containment

P1 within 24 hours

- Inventory every Okta (or equivalent IdP) tenant that fronts workforce or third-party applications and confirm which ones expose directory group and entitlement data to integrated apps. The Icepick leak shows group membership alone is enough to map access to sensitive tools.
- Review IdP audit logs for anomalous sign-ins against privileged or sensitive groups over the past 90 days: impossible travel, new device enrolment, MFA factor changes, and bulk directory or group enumeration. Okta's denial covers its own systems, not customer-tenant abuse, so tenant-side review is the control that applies.
- For any group granting access to sensitive third-party tools (location, biometric, surveillance-class services), confirm membership is least-privilege and re-validate the business need for each member.

P2 within 72 hours

- Enforce phishing-resistant MFA (FIDO2/WebAuthn) for all identities in groups with access to critical or important functions, and remove SMS or push-only factors from those cohorts.
- Restrict which integrated applications can read full directory group membership; scope app grants to the minimum attribute set the application needs.
- Where a third-party tool is reachable through SSO, confirm the vendor contract records the entitlement data shared and the notification duties if that data is exposed (see DORA Art. 30 obligations in your own contract register).

P3 within 7 days

- Add IdP group and entitlement changes to the monitored change feed, alerting on additions to sensitive groups outside an approved workflow.
- Brief staff whose work contact details and role titles are public-facing on targeted phishing and social-engineering risk, and give them a route to report unusual contact.

## 5\. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IPs, file paths) are available in the source material. The item describes a data-theft and publication event, not malware, so there is nothing machine-pivotable to enforce.

Behavioural indicators

| behaviour                                                                                                        | where to observe                                   | confidence                                                                     |
| ---------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | ------------------------------------------------------------------------------ |
| Sign-in to a workforce SSO tenant from an unusual location or device, followed by directory or group enumeration | IdP audit logs (Okta System Log or equivalent)     | Medium, inferred from the claimed SSO access path; not confirmed by the source |
| Bulk export or read of Active Directory group membership and user attributes                                     | Directory service auditing, IdP reporting API logs | Medium, inferred; the leaked fields match directory attributes                 |
| New or modified group membership granting access to sensitive third-party tools                                  | IdP and directory change logs                      | Low, no evidence of persistence in the source                                  |

## 6\. Detection

Insufficient indicators to author detection rules. The source provides no malware artefacts, command lines, file names, registry keys or distinctive strings, and the behavioural signals above are inferred rather than observed. Detection effort should go to IdP audit-log analytics for the sign-in and enumeration patterns in §5, built against your own tenant's baseline rather than any indicator from this item.

## 7\. Sources

- Malwarebytes, "Hackers steal and publish data on 41,000 Homeland Security workers", https://www.malwarebytes.com/blog/data-breaches/2026/10/hackers-steal-and-publish-data-on-41000-homeland-security-workers, 2026-10-30.
- The article cites TechCrunch (timestamps indicating mid-August exfiltration), Reuters (cross-referencing of six employees' records) and the Guardian (job titles showing sensitive assignments). These are secondary citations within the Malwarebytes report; the underlying pieces were not independently reviewed for this advisory.

## 8\. Adverse Trace position

Adverse Trace assesses this as a data-exposure and identity-compromise event with no associated CVE, CVSS score or CISA KEV entry, and treats the Department of Peace, maia arson crimew and DDoSecrets attribution as unconfirmed because none has a MITRE ATT&CK profile and the SSO access route rests on the group's own claim. Direct impact on EMEA financial services is low; the transferable risk is the SSO and directory-group exposure model, where one compromised identity and its group memberships reveal which staff can reach which internal and third-party tools. The headcount and dataset figures are single-sourced to the Malwarebytes reporting and should be verified before any client-facing use. We will monitor for further publication of the Icepick dataset, for any Okta tenant-side advisory, and for reuse of the leaked directory data in targeting, and will update this note if the initial access vector is confirmed. Clients wanting to test their own exposure to this pattern should start with the P1 IdP audit-log review in §4.

---

[Read the original source →](https://www.malwarebytes.com/blog/data-breaches/2026/10/hackers-steal-and-publish-data-on-41000-homeland-security-workers?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*