DHS Okta Data Breach: 41,000 Employee Records Leaked, and the SSO Checks Businesses Should Run
Records on more than 41,000 DHS employees, which a hacker says came from the agency's Okta single sign-on system, were published online. Here is what is confirmed, what is only claimed, and the Okta checks to run this week.
Where United States · North America, United States & Canada
On this page 6 sections
Records on more than 41,000 U.S. Department of Homeland Security employees were published online on October 28, 2026, and a hacker says they were taken from the agency's Okta single sign-on system. This matters to any business that signs in through Okta or a similar service because the leak includes more than names and phone numbers: it also shows which systems and apps each person is allowed to open, which is exactly what an attacker wants to know before going after a company network.
Okta says its own systems were not compromised, and nobody has reported how the data was taken. Below is what is confirmed, what is only claimed, and the sign-on checks worth running this week.
What happened in the DHS Okta breach
TechCrunch first reported the leak on October 28, 2026. A hacker using the name "Department of Peace" claimed the data came from the Okta single sign-on system that DHS employees and contractors use. According to TechCrunch, the hacker gave the data to journalist maia arson crimew, who then shared a copy with Distributed Denial of Secrets (DDoSecrets), a nonprofit that hosts leaked datasets. DDoSecrets published the archive the same day under the name "Icepick" and says it covers more than 41,000 employees.
TechCrunch reports that timestamps in the records suggest the data was taken around mid-August 2026. TechCrunch also says this is the second DHS breach this year claimed by the same hacker, after a March claim involving contract data.
According to TechCrunch and SecurityWeek, the records include:
- names, job titles and office locations
- work email addresses and cell phone numbers
- IT and sign-in records
- Active Directory group memberships
- which systems and internal apps each user is permitted to access
TechCrunch counts about 21,000 records tied to U.S. Customs and Border Protection, about 10,000 tied to ICE and its Homeland Security Investigations unit, just under 1,000 tied to CISA, and thousands more from headquarters, USCIS and other agencies. That is roughly one-fifth of a DHS workforce of around 220,000.
DHS breach: claimed vs confirmed
| Point | Status |
|---|---|
| Records on more than 40,000 DHS staff were published online | Confirmed: DDoSecrets published them on October 28, 2026 |
| The data is genuine | Partly confirmed: TechCrunch matched several known DHS employees and says the data "appears authentic" but is incomplete |
| The data came from DHS's Okta single sign-on system | Claimed by the hacker, not independently confirmed |
| Okta itself was breached | Denied: Okta says "Okta is secure, and we have no evidence our data or systems were compromised" |
| DHS acknowledges a problem | DHS says it "is aware of a potential breach and is actively working to address the situation swiftly and effectively" |
What is not known: how the hacker got in, whether the weakness has been closed, whether DHS knew about the theft before the reports, and the full scope of the data, since TechCrunch verified only part of it. The hacker did not respond to TechCrunch's questions. Any article naming a specific cause right now is guessing.
Why an SSO breach matters for a company network
Single sign-on (SSO) means one login opens email, file storage, finance tools and every other app connected to it. That convenience makes the SSO directory one of the most valuable systems a business runs. Gary Barlet, public sector CTO at Illumio, told SecurityWeek that the access information is the most concerning part of this leak, because an attacker has been handed "a roadmap for where to go next."
Our own view, separate from the reporting: the same risk applies to any business. A list of group memberships and app access tells an outsider whose inbox is worth a convincing phishing email. You do not have to be a federal agency for that list to be worth stealing, and protecting it does not need anything exotic. It needs careful setup of the sign-on system you already pay for.
Okta security checklist for this week
Every item below comes from Okta's published best practices for securing admin accounts or its guide to blocking anonymizing services. If you use Microsoft Entra ID or Google Workspace, the same ideas apply, but the menu names are different.
| Check | How to do it in Okta | Why it matters |
|---|---|---|
| Admins use phishing-resistant MFA | Require WebAuthn (FIDO2) or Okta FastPass, and require Admin Console sign-in from a registered device through FastPass | Codes and push prompts can be phished; these cannot |
| Everyone is enrolled in MFA | Run the MFA Enrollment by User report | Finds accounts that slipped through |
| Fewer admins | Keep admins and super admins to a minimum, use custom admin roles, audit with the Admin role assignment report | Fewer high-value accounts to steal |
| Review admin sign-ins | Search the System Log for eventType eq "user.session.access_admin_app" and look for odd times or new IP addresses |
Catches misuse early |
| Deny anonymizing proxies | Add authentication policy rules that deny anonymizing proxies; with Dynamic Zones, block Tor and residential proxies your staff do not need | Okta says attackers rely heavily on these networks |
| Turn on ThreatInsight | Set it to log and enforce | Flags and blocks suspicious sign-in attempts |
| Shorter admin sessions | Use short idle timeouts and require reauthentication when a session is reused from a different network (ASN binding) | Makes a stolen session less useful |
| Catch-all deny rule | Make the last rule in every policy an explicit deny | Stops fallback to a weaker sign-in method |
| Service accounts | Use API service integrations instead of user accounts, and rotate client secrets often | Integration accounts are easy to forget |
| Password resets | For privileged accounts, require extra verification or turn off self-service reset | Resets are a common takeover path |
Okta says the basic anonymizer protections, ThreatInsight in log and enforce mode plus policies that deny anonymizing proxies, are available in all Okta SKUs on Okta Identity Engine. Allowing or denying specific anonymizers needs the Dynamic Zones license that comes with the Adaptive MFA SKU.
CISA's guidance supports the first row. Its MFA page says phishing-resistant MFA "is the standard all industry leaders should strive for" and that "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication." If you cannot move everyone yet, CISA suggests number matching for push approvals in the meantime.
DHS Okta breach questions people are asking
Was Okta hacked?
Okta says no. A spokesperson said "Okta is secure, and we have no evidence our data or systems were compromised." The hacker's claim is about the Okta system DHS uses, and how the data was taken has not been reported.
How many DHS employee records were leaked?
DDoSecrets says more than 41,000 employees. TechCrunch puts the number at more than 40,000.
What information was in the DHS data leak?
Names, job titles, work emails, cell phone numbers, office locations, sign-in records, Active Directory group memberships, and which systems each person can access.
When did the DHS breach happen?
TechCrunch says timestamps point to mid-August 2026. The data was published on October 28, 2026.
Who is the Department of Peace?
It is the handle of the hacker who claimed this breach and an earlier DHS contract data claim in March 2026. TechCrunch says the hacker did not respond to its questions.
Are other Okta customers affected?
No reporting so far shows that other Okta customers are affected. It is still a good time to check how your own sign-on system is set up.
What is phishing-resistant MFA?
It is sign-in protection that a fake login page cannot capture and replay, such as FIDO2 security keys, passkeys or Okta FastPass. CISA calls FIDO/WebAuthn the only widely available option.
The bigger lesson
The most sensitive system in a company is often not the database or the file server. It is the login service that decides who can open them. Treat your sign-on directory as a crown-jewel system: lock down its admins, watch its logs and remove the weaker paths in.
Want a second set of eyes on your sign-on setup? See our security hardening services or request a quote.
Get security alerts like this by email, plus our free checklist, at EPE Security Alerts.
Sources: TechCrunch; SecurityWeek; DDoSecrets: Icepick; Okta: Securing admin accounts; Okta: Blocking anonymizing services; CISA: More than a password.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Moldova Cyberattack: State Actor Suspected After Citizen Data Was Taken From Government Systems, What Is Confirmed and What to Check
Moldova says hackers accessed the personal data of about 450,000 citizens through government digital services....
Park Dental Data Breach Settlement: Up to $2,500 for Patients, a December 28 Claim Deadline, and Why the Case Is Still Not Over
Park Dental patients have until December 28, 2026 to claim up to $2,500 or $60, plus credit monitoring, over a...
Rosstat Cyberattack: Russia's Statistics Agency Is Still Restoring Systems, What Is Confirmed and What Businesses Should Check
Rosstat says it is still restoring systems after cyberattacks from October 29 to November 1, 2026. Hackers cla...
