Security News

Leaked DHS Employee Archive Resurfaces Online After Takedown Attempt

CyberScoop · 30 Oct 2026

Key Takeaway Once leaked data is published online, takedowns are unreliable, so limit the staff details your business exposes and plan for the possibility that employee information could be misused.

A search tool called Icepick, which exposes information on more than 41,000 Department of Homeland Security (DHS) employees, has proved hard to remove from the internet. Hacktivists say they obtained the data from a breached DHS database. A company working on behalf of DHS sought to cut off access to the archive.

Icelandic hosting company FlokiNET said DHS contractor ZeroFox asked it to remove the data, and that it refused. It said the request wrongly labelled the archive as part of a doxxing campaign, arguing that the data covers work identities and roles rather than private lives. FlokiNET said the site went down anyway when its registrar, CentralNic, placed the domain on serverHold. The site then returned under a domain from a different registrar. CentralNic and ZeroFox did not immediately respond to requests for comment.

DHS said it is aware of a potential breach and is working to protect its employees, and it promised to update the public. Separately, Bluesky was blocking links to the archive because it shared people's contact information without their permission. A company official said changes were coming, because the wording had identified it as a malicious link.

data breach DHS hacktivism doxxing data leak

Summarised by CISO AI from CyberScoop, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.