Hackers Publish Personal and AD Group Data of 41,000 U.S. Homeland Security Employees
What Happened — A hacktivist collective calling itself the “Department of Peace” stole and publicly released a dataset (“Icepick”) containing names, work email addresses, phone numbers, office locations, job titles, and Active Directory group memberships for more than 41,000 employees of the U.S. Department of Homeland Security (DHS). The dump includes roughly 6,600 Immigration and Customs Enforcement (ICE) staff, 21,000 Customs and Border Protection (CBP) staff, and personnel from the Cybersecurity and Infrastructure Security Agency (CISA). The data were handed to Swiss hacktivist maia arson crimew and posted via the transparency collective DDoSecrets in early October 2026. DHS has acknowledged a “potential breach” and is advising affected workers to verify unexpected contacts and report threats.
Why It Matters for Trust & Control Assurance — The exposure of AD group memberships highlights gaps in identity‑and‑access governance; continuous monitoring of privileged group changes is a core control that underpins many frameworks (e.g., NIST CSF 2.0).
Who Is Affected — Federal government agencies, specifically DHS components (ICE, CBP, CISA) and any contractors with access to DHS networks.
Recommended Actions
- Audit Active Directory group memberships for over‑privileged assignments.
- Deploy continuous monitoring and alerting on AD changes to generate defensible audit evidence.
- Review and tighten least‑privilege policies for all privileged accounts.
- Conduct targeted security‑awareness briefings for staff whose personal data were exposed.
- Update incident‑response playbooks to include OSINT‑driven doxxing scenarios.
Source: Malwarebytes Labs
Technical Notes
- Attack vector not disclosed; likely a compromise of internal credential stores or privileged AD access.
- No Social Security numbers were released, but the combination of personal identifiers and group memberships enables credential‑stuffing, spear‑phishing, and physical targeting.
- Data were first observed in mid‑August 2026; publication occurred in early October 2026.