DHS Icepick leak surfaces group names tied to Grok and Palantir

A hacktivist collective calling itself the Department of Peace dumped records on more than 41,000 Department of Homeland Security employees and contractors, and the archive, published Wednesday by Distributed Denial of Secrets under the name "Icepick," catalogues internal DHS permission groups that reference Palantir, Grok, ChatGPT, Gemini and Copilot.

Swiss hacker and journalist maia arson crimew previewed the data for Wired, which first reported it. The hacktivists say the database came from the Okta single sign-on service DHS uses. The vendor rejects that. "Okta is secure, and we have no evidence our data or systems were compromised," an Okta spokesperson told the magazine.

Beyond names, emails, phone numbers and office addresses for personnel across ICE, CBP and HSI, the archive lists over 55,000 group names. CyberScoop reports the dataset provides "an unprecedented look into the Department of Homeland Security's organizational structure" and identifies "key personnel in DHS's ever-escalating rendition and deportation programs." Separately, reviewers found 39 HSI employees across more than a dozen field offices sitting in groups whose names include "CUC" — initials that government court filings say stand for "certified undercover operation."

The attached note is blunt. "They have our information, so it's only fair that we have theirs," the hackers wrote. Another passage reads: "On July 17th, Markwayne Mullin said he was 'turning up the heat.' This is what happens to ICE when you do that."

Seven of the analysts on our radar had the Wired piece in their feeds today. Whether DHS or Okta ends up confirming the claimed SSO vector is the next thing to settle; so far it is the only part of the story the vendor is pushing back on.