Icepick DHS Leak: Why a Directory Dump Is an Attack Map

The Icepick DHS leak went public on Wednesday, Oct. 28, 2026, when DDoSecrets published records on more than 41,000 Department of Homeland Security employees and contractors, last updated Aug. 19, 2026. Its permission groups point to ICE staff in certified undercover operations. For anyone who manages a corporate directory, the lesson is that a directory listing is reconnaissance on its own, with no password required.

What did DDoSecrets publish in the Icepick archive?

Distributed Denial of Secrets (DDoSecrets) released Icepick on Wednesday, Oct. 28, 2026, after previewing it for WIRED with researcher and journalist maia arson crimew. The records cover more than 41,000 employees and contractors at DHS headquarters and seven component agencies, including Immigration and Customs Enforcement (ICE) and US Customs and Border Protection (CBP). They were last updated on Aug. 19, 2026.

By WIRED’s count, CBP staff make up more than half the records. ICE accounts for about 10,000, roughly a third of them in Homeland Security Investigations (HSI), its investigative wing. US Citizenship and Immigration Services has about 6,200 and CISA nearly 1,000, more than half of them contractors. That is about a seventh of the DHS workforce.

The records hold work email addresses, phone numbers and office addresses, but the access data is more revealing: most entries name a supervisor, and more than 55,000 permission groups control who can use which internal systems. crimew has built a website that makes the whole set searchable.

DDoSecrets and crimew say they got the data from a group calling itself the Department of Peace, whose note with the files reads: “They have our information, so it’s only fair that we have theirs.” DDoSecrets’ press release says the data comes from DHS’s Okta login system. Okta told WIRED it has no evidence its data or systems were compromised. DHS said it is “aware of a potential breach” and is working to address it.

Those statements can all be true. Customer directory data can leave a tenant through a stolen admin session, an over-scoped API token or a sync integration without the vendor’s platform being breached. Nobody has said which, if any, applies here.

Why do undercover ICE identities change the harm model?

Undercover staff change the harm model because being listed at all is the exposure. At HSI, 39 employees across more than a dozen field offices belong to permission groups whose names include “CUC,” which government court filings say stands for “certified undercover operation.” Other group names reference a Title III wiretap program and communications intercept programs.

A phone book of 41,000 federal employees is a phishing list. One that also flags people whose work depends on not being linked to their agency is a targeting list.

From the attacker’s side, a covert role tied to an ordinary directory identity yields a real name, or at least a name format, plus an organizational anchor. Public records, social media, property data and relatives’ accounts then supply location and associates. The correlation happens upstream, in a system the person never controlled.

Alexander Leslie, a national security expert at Recorded Future, told WIRED the dataset “becomes way more valuable when correlated with previously compromised information, commercial data, and other intelligence collections.” An adversary, he said, “could spend months exploiting these relationships to identify vulnerable personnel, develop convincing impersonation attempts, or compromise ongoing investigations.”

The individuals and their families carry the risk first: physical targeting, harassment and compromised cover. The agency must reassess any case that relied on someone’s cover.

Most of our readers run a directory with the same weakness at lower stakes per record. Private companies employ people with prior covert, cleared or liaison roles: former investigators on fraud teams, ex-military staff in security operations, employees who act as law-enforcement points of contact. HR and SSO directories usually treat them like everyone else, and in most default tenants, job title, manager, department and group membership are readable by every authenticated user.

If your directory leaked tomorrow, you should already know which identities would be dangerous to expose and who can read them today.

What does a directory export give an attacker?

A directory export gives an attacker the organization’s structure before they hold a single credential. In our assumed-breach engagements, a tenant-wide user and group listing is consistently the most valuable thing we collect in the first hour. Icepick shows why at government scale.

• Reporting lines. Most records name a supervisor, enough to rebuild the org chart, and more than 300 carry senior headquarters titles. A pretext caller learns whom to impersonate and whose request staff will act on without checking.
• Tool inventory. Group names reference Palantir’s Falcon investigative platform, PenLink, OpenAI’s ChatGPT, Google’s Gemini and Microsoft’s Copilot. More than 700 accounts, nearly all CBP, sit in a group apparently tied to Signal, and more than 200 CBP accounts in one tied to Mobile Fortify, a face-recognition app.
• Policy exceptions. Two groups, “Executive Leadership” and “AI Access,” appear to list the same 13 people exempted from the DHS web filter, including former DHS head Kristi Noem. A list of who bypasses a control is a list of whose browser to target.
• Outside populations. About 4,400 “associates,” 145 labeled “contractor” or “high risk contractor,” appear alongside county sheriff’s staff with 287(g) immigration authority and nearly 20 Defense Department accounts. Contractor accounts are often managed with weaker controls.

Administrators name groups after what they grant: a program, an application, a VPN profile, a database role. Read in bulk, 55,000 group names describe privileges and tool access more plainly than a vulnerability scan does, and tell an attacker which identity to compromise to reach a given system. Phishing stops being a numbers game and becomes a shortlist.

The real question is blast radius from an identity foothold. That is what an assumed breach assessment measures: starting from one ordinary user, how many hops to a privileged group, a sensitive application, or a person who should never have been enumerable?

How does a government leak become contractor reconnaissance?

A government identity leak reaches private companies through the people and trust links on both sides of the boundary. Contractor staff usually connect to agency identity systems through federated sign-in, guest accounts in an agency tenant, or app assignments that give them agency tools, and agency liaisons get invited into vendor collaboration spaces. A dump from the agency therefore doubles as reconnaissance against its vendors. It can expose:

• the naming conventions the agency assigned to vendor staff, which often mirror their corporate usernames;
• partner email domains, which show which firms hold contracts and who works on them;
• individuals who also exist in a vendor identity provider, often with access to the same projects.

Those people become the obvious phishing route into the contractor, where controls tend to be looser. At CISA, where contractors hold more than half of the nearly 1,000 records, that route leads into firms supporting the agency responsible for federal civilian cyber defense.

WIRED has not reported whether Icepick’s contractor and partner entries are guest, federated or native accounts. The failures that make the pattern dangerous are familiar:

• Excessive guest scope. Guests who can enumerate the host tenant’s users and groups much as members can.
• Standing group membership. Contractors added to project groups and never removed when the task order ends.
• App consent that outlives the contract. Integrations with broad directory read permissions that keep working after the relationship stops.

Each was a decision someone made once and nobody revisited. Tracing those trust paths end to end is the job of OAuth, OIDC, and SAML SSO testing.

What should a security lead test after the Icepick DHS leak?

Test whether your own identity store would produce the same map after a single foothold, and who can read it today. Scope it as an authorized identity assessment, not incident response for a breach you do not have.

Enumeration resistance

Check what a plain member, a guest and a low-privilege application can list. In Microsoft Entra ID, guest and member directory read permissions are tenant settings. In Okta, the platform DDoSecrets names as the source, admin role assignments and API token scopes govern similar access. The finding that matters is any non-admin principal that can pull every user, group and role assignment in bulk. Our Entra ID security assessment treats this as a first-day check.

Sensitive roles as a data class

Identify people whose role, manager or group membership is sensitive in itself: investigators, insider-risk staff, executive protection, law-enforcement liaisons. Restrict who can read those attributes, and keep those memberships out of descriptively named groups. Icepick shows that even an abbreviation is descriptive once court filings decode it.

Contractor and federation hygiene

• Review standing access for contractors and guests against active contracts.
• Inventory federation trusts and confirm each still has an owner.
• Find OAuth grants and app registrations whose consent exceeds need, especially tenant-wide directory read.
• Treat membership of policy-exception groups, such as web-filter or conditional access exclusions, as sensitive data.

Detection

Confirm your logging would show a bulk directory export. Sign-in logs alone will not. You need audit or API activity telemetry with volume baselines (Okta System Log, Entra audit logs, Microsoft Graph activity logs), kept long enough to reconstruct an event months later. Icepick’s records were last updated about ten weeks before they surfaced.

Practitioner’s note: In our identity engagements the most common serious finding is not a missing patch. It is an old service principal or integration with tenant-wide read access, owned by someone who has left, that nobody monitors. Pulling the full directory through one of those raises no alert in most environments we test.

How should teams handle the archive if they must review it?

Most companies will never need to touch the archive. Those that might, typically DHS contractors checking whether their staff are listed, should treat it as hostile input and legal exposure, and set rules before anyone opens a file.

• Isolate. Work in a disposable, network-isolated environment. Keep a pristine original and record a SHA-256 hash before extracting anything. A matching hash proves two copies are identical, not that the contents are genuine or when they were taken.
• Never test found credentials. If passwords, tokens or keys appear, do not try them against any service. Check your own logs and rotate through authorized controls.
• Search logs with validated data only. Use confirmed account names, hostnames and timestamps against Okta System Log, Entra sign-in and audit logs, Google Workspace or AWS CloudTrail. The word “Icepick” is not an indicator of compromise.
• Limit access. Need-to-know only, with counsel involved before anyone redistributes material or contacts affected people.

Redistribution carries its own risk. Adam Steinbaugh of the civil liberties group FIRE says the administration has taken an expansive view of 18 USC 119, which bars sharing “restricted personal information” about federal officers with intent to threaten them. In June, 15 Minnesota residents were charged under stalking and threat laws that prosecutors linked to ICE-opposition activity.

What is still unconfirmed about Icepick?

Almost everything beyond the fact of publication and the contents WIRED analyzed. As of Oct. 30, 2026:

• Who took it. “Department of Peace” is a name the source chose for itself. Authenticating the files, dating the theft and naming the actor remain publicly unsettled.
• Which system and how. DDoSecrets says the data comes from DHS’s Okta login system; Okta says it has no evidence of compromise. No one has described how access was obtained.
• Authenticity and currency. DHS has acknowledged only a “potential breach.” The records date to Aug. 19, 2026, so some roles will have changed. Leslie’s assessment is explicitly conditional: “if authentic and current.”
• The covert share. Membership in a “CUC” group shows access tied to an undercover operation. It does not prove that each of the 39 people works undercover.

The defensible statement is narrow: a DHS workforce directory covering more than 41,000 people, with access groups that point to undercover and surveillance programs, is now public and searchable. The identity lessons for everyone else do not depend on the open questions.

FAQ

What is the Icepick DHS leak?

Icepick is an archive DDoSecrets published on Oct. 28, 2026, covering more than 41,000 Department of Homeland Security employees and contractors. It includes contact details, supervisors and more than 55,000 permission groups, some tied to undercover and surveillance programs.

Was the DHS identity provider breached?

DDoSecrets says the data comes from DHS's Okta login system, while Okta says it has no evidence its systems or data were compromised. DHS has acknowledged only a potential breach, and the access method has not been reported.

Are ICE undercover identities in the DDoSecrets leak?

WIRED found 39 HSI employees in permission groups whose names include "CUC," which court filings say means certified undercover operation. Membership shows access tied to such operations, not that every member works undercover.

What should security teams check after Icepick?

Check what members, guests and low-privilege apps can enumerate, restrict who can read sensitive-role attributes and exception groups, and remove stale contractor access and over-scoped app consent. Then confirm logging would catch a bulk directory export.

If you want to know what your own directory would reveal after a single compromised account, agent::offense runs authorized identity and access security testing across Entra ID, Okta and federated environments, including contractor trust paths. We start from one ordinary user and show you the map an attacker would draw.