conv.

All stories
SecurityQuiet 5d · day 11

Hack exposes 41,000 DHS/ICE staff; Bluesky blocks links as DHS seeks takedowns

A hacker group calling itself Department of Peace breached DHS's Okta login system, leaking contact and operational details on tens of thousands of agents.

What to know

  • More than 41,000 DHS employee and contractor records were exposed, roughly a seventh of the department's workforce, with CBP (~21,000) and ICE/HSI (~10,000) the largest components.
  • The hacker group Department of Peace says it pulled the data from DHS's Okta single sign-on system; Okta says it has no evidence its own systems were compromised.
  • The data was published via DDoSecrets with researcher maia arson crimew, who built a searchable site that went offline after a reported DHS takedown demand to the domain registrar.
  • Bluesky's decision to block links to the leaked archive, citing unauthorized sharing of contact information, drew criticism from users who called it inconsistent or censorious.

The dispute Whether exposing the identities of all 41,000 workers—including those in roles far removed from ICE enforcement—constitutes fair accountability or reckless, overbroad doxxing. · positions read across 206 posts and comments

many voices

The leak is justified accountability given documented ICE conduct, including masked/badge-free agents using force.

  • “Now that this data has been leaked, identities can be correlated with facial recognition, gait analysis, and other biometric…”

    resters · Hacker News ↗
some voices

The leak is overbroad and endangers staff whose jobs are unrelated to immigration enforcement.

  • “There are people whose responsibilities are far removed from ICE's activities.”

    orthogonal_cube · Hacker News ↗
many voices

Bluesky's blocking of leak links is hypocritical or inconsistent censorship given its investors and other outlets still linking freely.

  • “Bluesky is VC-funded, biggest investor: Blockchain Capital. Remember this excuse next time there is a le…”

    rysiek · Mastodon ↗

Department of Peace Hacker groupmaia arson crimew Journalist and cybersecurity researcherDDoSecrets (Emma Best) Transparency nonprofit that published the leakDepartment of Homeland SecurityDepartment of Homeland Security Breached federal agencyOkta Single sign-on vendor allegedly used to access the dataBluesky Social platform

Hack exposes 41,000 DHS/ICE staff; Bluesky blocks links as DHS seeks takedowns
techcrunch.com

How it unfolded 6 developments, newest first · click a bar or a number to jump articlespostscomments

Peak 91 pieces in 3h at Oct 28, 8 PM; 399 pieces over 11 days (129 articles · 201 posts · 69 comments) Oct 28, 11 AM — 15 pieces · 15 articles — Newswires 15Oct 28, 2 PM — 37 pieces · 9 articles · 26 posts · 2 comments — Mastodon 20, Newswires 6, Bluesky 5, +2 moreOct 28, 5 PM — 39 pieces · 9 articles · 18 posts · 12 comments — Mastodon 11, Hacker News 10, Bluesky 7, +3 moreOct 28, 8 PM — 91 pieces · 43 articles · 36 posts · 12 comments — Newswires 39, Mastodon 25, Reddit 11, +4 moreOct 28, 11 PM — 47 pieces · 13 articles · 19 posts · 15 comments — Reddit 15, Mastodon 13, Newswires 7, +3 moreOct 29, 2 AM — 18 pieces · 7 articles · 4 posts · 7 comments — Reddit 7, Newswires 5, Mastodon 2, +3 moreOct 29, 5 AM — 28 pieces · 5 articles · 20 posts · 3 comments — Mastodon 14, Hacker News 5, Newswires 4, +3 moreOct 29, 8 AM — 48 pieces · 6 articles · 34 posts · 8 comments — Bluesky 19, Mastodon 15, Hacker News 9, +3 moreOct 29, 11 AM — 20 pieces · 7 articles · 9 posts · 4 comments — Newswires 7, Bluesky 7, Hacker News 4, +1 moreOct 29, 2 PM — 11 pieces · 5 articles · 6 posts — Newswires 5, Mastodon 4, Bluesky 2Oct 29, 5 PM — 7 pieces · 3 articles · 3 posts · 1 comment — Mastodon 3, Bluesky 2, Newswires 1, +1 moreOct 29, 8 PM — 5 pieces · 5 posts — Mastodon 4, Bluesky 1Oct 29, 11 PM — 3 pieces · 2 posts · 1 comment — Bluesky 1, Hacker News 1, Mastodon 1Oct 30, 2 AM — 2 pieces · 1 post · 1 comment — Mastodon 1, Hacker News 1Oct 30, 5 AM — 1 piece · 1 post — Bluesky 1Oct 30, 8 AM — 3 pieces · 2 posts · 1 comment — Hacker News 1, Bluesky 1, Mastodon 1Oct 30, 11 AM — 10 pieces · 6 articles · 4 posts — Newswires 6, Bluesky 3, Mastodon 1Oct 30, 2 PM — 1 piece · 1 post — Mastodon 1Oct 30, 5 PM — 1 piece · 1 post — Bluesky 1Oct 30, 8 PM — 1 piece · 1 post — Bluesky 1Oct 30, 11 PM — 1 piece · 1 post — Bluesky 1Oct 31, 2 AM — 1 piece · 1 post — Mastodon 1Oct 31, 5 AM — 1 piece · 1 post — Bluesky 1Oct 31, 8 AM — 1 piece · 1 comment — Hacker News 1Oct 31, 11 AM — 1 piece · 1 post — Mastodon 1Oct 31, 2 PM — 1 piece · 1 post — Mastodon 1Oct 31, 5 PM — quietOct 31, 8 PM — 1 piece · 1 post — Mastodon 1Oct 31, 11 PM — quietNov 1, 1 AM — quietNov 1, 4 AM — quietNov 1, 7 AM — quietNov 1, 10 AM — quietNov 1, 1 PM — quietNov 1, 4 PM — 1 piece · 1 article — Newswires 1Nov 1, 7 PM — quietNov 1, 10 PM — quietNov 2, 1 AM — quietNov 2, 4 AM — 1 piece · 1 post — Bluesky 1Nov 2, 7 AM — quietNov 2, 10 AM — 1 piece · 1 post — Mastodon 1Nov 2, 1 PM — quietNov 2, 4 PM — quietNov 2, 7 PM — quietNov 2, 10 PM — quietNov 3, 1 AM — quietNov 3, 4 AM — quietNov 3, 7 AM — quietNov 3, 10 AM — quietNov 3, 1 PM — 1 piece · 1 comment — Hacker News 1Nov 3, 4 PM — quietNov 3, 7 PM — quietNov 3, 10 PM — quietNov 4, 1 AM — quietNov 4, 4 AM — quietNov 4, 7 AM — quietNov 4, 10 AM — quietNov 4, 1 PM — quietNov 4, 4 PM — quietNov 4, 7 PM — quietNov 4, 10 PM — quietNov 5, 1 AM — quietNov 5, 4 AM — quietNov 5, 7 AM — quietNov 5, 10 AM — quietNov 5, 1 PM — quietNov 5, 4 PM — quietNov 5, 7 PM — quietNov 5, 10 PM — quietNov 6, 1 AM — quietNov 6, 4 AM — quietNov 6, 7 AM — quietNov 6, 10 AM — quietNov 6, 1 PM — quietNov 6, 4 PM — quietNov 6, 7 PM — quietNov 6, 10 PM — quietYesterday, 1 AM — quietYesterday, 4 AM — quietYesterday, 7 AM — quietYesterday, 10 AM — quietYesterday, 1 PM — quietYesterday, 4 PM — quietYesterday, 7 PM — quietYesterday, 10 PM — quietToday, 1 AM — quietToday, 4 AM — quietToday, 7 AM — quietToday, 10 AM — quiet 1–23–456
Oct 29Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6yesterdaynow · 1:51 PM ET
  1. 6

    Philadelphia Inquirer identifies ~300 local DHS staff in leak

    Local reporting narrowed in on nearly 300 Philadelphia-area DHS and ICE personnel whose information appeared in the breached records, illustrating the leak's reach into individual field offices.

    1. first by Philadelphia Inquirer, 6d ago

    • DevaOnBreaches@infosec.exchange

      The US Department of Homeland Security (DHS) is investigating a potential # databreach after hackers claimed to have leaked personal details of 41,000+ employees. Exposed data reportedly includes contact details, job roles, and more. https://www. malwarebytes.com/blog/data-bre…

      DevaOnBreaches@infosec.exchangeMastodon7d agoview on Mastodon ↗
    2 more of the top 3 · 5 posts in this stretch
    • Yeah tough shit. As soon as they reopened a former Japanese internment camp in El paso people should have raised he'll. Not been 1930s German citizen 2.0

      whattheheckheckHacker News4d agoview on Hacker News ↗
    • MediaActivist@todon.eu

      The "Icepick’ leak exploited by a hacker known as “Department of Peace” has exposed thousands of Homeland Security personnel, groups and more: https:// unicornriot.ninja/2026/icepick -leak-exposes-thousands-of-homeland-security-personnel-groups-and-more/

      MediaActivist@todon.euMastodon6d agoview on Mastodon ↗
    all of them →
  2. 1 day quiet
  3. 5

    Wire coverage details sensitive operations exposed in leak

    Syndicated reporting across regional outlets highlighted that the leak exposed not just contact details but information tied to sensitive and undercover DHS operations and the technology vendors involved.

    1. first by GovExec, 9d ago · also Nextgov, Nextgov/FCW

    2. first by KDFX-TV, 10d ago

    • UnicornRiot@mastodon.social

      The Icelandic host flokinet has rebuffed the ZeroFox attempt to take the Icepick DHS leak site down, refuting the claim that business contact records are “doxxing.” -- Updates at end of story https:// unicornriot.ninja/2026/icepick -leak-exposes-thousands-of-homeland-security-personnel-groups-and-more/

      UnicornRiot@mastodon.socialMastodon9d ago1▲view on Mastodon ↗
    2 more of the top 3 · 18 posts in this stretch
    • hollie.bsky.social

      AAaaand, this is why I'm on Mastodon. When you tire of corporate media's instant capitulation to fascism, come say hello!

      hollie.bsky.socialBluesky9d ago1▲view on Bluesky ↗
    • They should all spend the next term in the prisons they're kidnapping people into. Going to be interesting explaining this to future employers who will now be more equipped to identify new hires, or current hires that don't align.

      0xR1CKHacker News9d agoview on Hacker News ↗
    all of them →
  4. 4

    DHS pressures registrar to take down crimew's searchable leak site

    A searchable version of the dataset built by maia arson crimew went offline after what TechCrunch reported was a DHS takedown demand sent to the site's domain registrar.

    • zackwhittaker@mastodon.social

      Bluesky is blocking links to DDoSecrets, which is hosting the leaked dataset of 40,000+ Homeland Security employees. A searchable version of the site hosted by maia arson crimew also appears down after a DHS takedown demand on the domain registrar. More: https:// techcrunch.com/2026/10/29/blue…

      zackwhittaker@mastodon.socialMastodon10d ago243▲view on Mastodon ↗
    2 more of the top 3 · 62 posts in this stretch
    • landonkat.bsky.social

      Details of thousands of US immigration officials leaked in major hack.

      landonkat.bsky.socialBluesky10d ago8▲view on Bluesky ↗
    • [dupe] https://news.ycombinator.com/item?id=50280864Source urls only please, save the lite/archives for comments.Full url: https://www.npr.org/2026/10/28/nx-s1-6021497/dhs-hack-ice (as submitted earlier

      ChrisArchitectHacker News10d agoview on Hacker News ↗
    all of them →
  5. 3

    Bluesky blocks links to the leaked DHS archive

    Bluesky told WIRED it was blocking links to the leaked archive because it contains people's contact information shared without their authorization, prompting accusations of censorship from users trying to share the data.

    “Bluesky tells WIRED it blocked links to a leaked archive of information on 41,000 ICE, CBP, and other DHS workers because it contains people's contact information, shared without their authorization.”
    — WIRED
    1. 3 outlets first by Mastodon, 10d ago · also TechCrunch, Wired · read ↗

    2. 1 outlet first by Wired, 10d ago · read ↗

    • rysiek@mstdn.social

      A database of thousands of US # ICE agents leaked and got posted on @ ddosecrets . Bluesky is blocking the link: https://www. wired.com/story/bluesky-blocks -links-to-major-leak-of-dhs-data/ > Bluesky tells WIRED it blocked links to a leaked archive of information on 41,000 ICE, CBP, and other DHS workers because it contains people’s contact…

      rysiek@mstdn.socialMastodon10d ago240▲view on Mastodon ↗
    2 more of the top 3 · 47 posts in this stretch
    • linusd.bsky.social

      6,600 masked and anonymous ICE agents amongst 41,000 DHS staff doxxed by hack. Details of thousands of US immigration agents leaked in major hack

      linusd.bsky.socialBluesky10d ago41▲view on Bluesky ↗
    • Not even going to comment on this as it clearly would not be a conversation if you think anything you’ve stated is specific to ice or republicans or this administration only. Look at some facts. Obama deported more people and had more deaths doing so than has happened now. Facts! Look into it with the story’s involving him while he was president…

      DrBerryMcCockinerr/news10d agoview on r/news ↗
    all of them →
  6. 2

    DHS confirms breach probe; Okta denies its systems were hit

    A DHS spokesperson said the agency was aware of a potential breach and working to address it, while an Okta spokesperson said the company found no evidence its own data or systems were compromised.

    “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected.”
    — DHS spokesperson
    1. first by HN Best, 10d ago · also Guardian, Decrypt, TechRadar, Cyber Daily, Slashdot, UNICORN RIOT +3

      8 more headlines
    • Bluesky tells WIRED it blocked links to a leaked archive of information on 41,000 ICE, CBP, and other DHS workers because it contains people’s contact information, shared without their authorization.

      @WIREDX10d ago469▲view on X ↗
    2 more of the top 3 · 68 posts in this stretch
    • micahflee.com

      Here’s TechCrunch covering it. But if a Bluesky user wants to click through to the source of the data to see for themselves, they get extra friction?

      micahflee.comBluesky10d ago115▲view on Bluesky ↗
    • ddosecrets@kolektiva.social

      Icepick (166.7 MB) An internal database identifying more than 41,000 employees for the U.S. Department of Homeland Security (DHS). https:// ddosecrets.org/article/icepick Support our mission:

      ddosecrets@kolektiva.socialMastodon10d ago32▲view on Mastodon ↗
    all of them →
  7. 1

    Department of Peace publishes 41,000 DHS personnel records

    A hacker group calling itself Department of Peace released a database of more than 41,000 DHS employee and contractor records—names, job titles, emails, cell numbers, office locations, and details of undercover and surveillance programs—through DDoSecrets, which previewed the data with cybersecurity researcher maia arson crimew.

    “They have our information, so it's only fair that we have theirs.”
    — Department of Peace
    1. first by The Washington Post, 10d ago · also Fox News, Times of India, Hindustan Times, Seeking Alpha, Washington Post

      4 more headlines
    2. first by The Hill, 10d ago · also eSecurity Planet, Help Net Security, Cyber Security News, The Verge, Wired

      7 more headlines
    8 more claims →
    • zackwhittaker@mastodon.social

      NEW: U.S. Dept. of Homeland Security was breached, allowing a hacker to scrape personnel and contact information data from its Okta sign-on system. The stolen data includes 40,000+ records across DHS agencies, including CBP, ICE, and HSI, as well as DHS leadership — and is now online via DDoSecrets. Read more: https://…

      zackwhittaker@mastodon.socialMastodon10d ago374▲view on Mastodon ↗
    2 more of the top 3 · 6 posts in this stretch
    • WarnerCrocker@mastodon.social

      Huh. Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents # ICE https://www. wired.com/story/massive-leak-e xposes-41000-homeland-security-workers-including-undercover-ice-agents/

      WarnerCrocker@mastodon.socialMastodon10d ago43▲view on Mastodon ↗
    • Viss@mastodon.social

      RE: https:// mastodon.social/@WarnerCrocker /117520330870385814 https:// ddosecrets.org/article/icepick theres the link to the data

      Viss@mastodon.socialMastodon10d ago23▲view on Mastodon ↗
    all of them →
  8. background

    Hacker exfiltrates DHS employee data via Okta — Timestamps on the leaked records show the data was exfiltrated around mid-August 2026, with the dataset last updated August 19, according to WIRED's and TechCrunch's analysis of the files.

Also covered reported alongside — the timeline has no entry for these yet

  1. first by Breitbart, 9d ago · also NYT Politics, ZeroHedge

    3 more headlines
  2. first by CNBC, 10d ago · also NY Post, Yahoo

    2 more headlines
  3. first by Daily Maverick, 10d ago · also Reuters, Channel News Asia

  4. first by Mastodon, 9d ago · also BBC

  5. first by UPI, 10d ago · also Breitbart

  6. first by Independent UK, 10d ago · also The Independent

  7. 2 outlets Icepick

    first by Distributed Denial of Secrets Recently …, 10d ago · also Distributed Denial …

  8. first by Investing.com News, 10d ago · also Reuters

and 5 smaller pieces

What people are saying 14 voices from 5 sites · best of 206 · verbatim

Still unanswered
  • How exactly was the Okta system accessed if Okta itself found no evidence of compromise?
  • Will Bluesky and other platforms maintain or reverse their blocking of links to the leaked data?