A leak dubbed “Icepick” contains records for more than 41,000 Department of Homeland Security employees and contractors across DHS and seven agencies, including CBP, ICE, USCIS, and CISA. The data, reportedly drawn from DHS’s Okta login system and last updated in August 2026, includes contact and office details, job titles, supervisors, and more than 55,000 system-permission groups. Those groups reveal sensitive operational connections: undercover ICE units, wiretap and surveillance programs, investigative tools such as Palantir and PenLink, facial-recognition software, and access to AI services. Records also identify personnel tied to Signal, military support at ICE facilities, local police immigration-enforcement partnerships, and senior DHS leadership. Okta says it has no evidence its systems were compromised.
The exposure could help outsiders map DHS’s structure and identify undercover personnel or ongoing operations. A national-security expert warns that combining the records with other data could enable targeted impersonation, staff exploitation, or interference with investigations. The leak arrives amid heightened scrutiny of DHS surveillance and enforcement, and government efforts to shield employees’ identities while treating some disclosures as doxing. Its publishers and researcher describe the archive as an accountability resource, arguing that basic work information about public officials should not be criminalized; a civil-liberties attorney likewise distinguishes such details from threats or private personal information. The records’ scale and operational clues make the leak both a potential security risk and an unusually detailed view of how the department works.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Attackers attempted to exploit critical GitLab vulnerability CVE-2026-97229 on Alpine Linux’s instance, crashing worker processes, but Alpine found no evidence of successful access or tampering. Alpine rebuilt the instance, reset passwords, and warns that self-managed GitLab deployments also need patched Ruby - not just a GitLab upgrade. (alpinelinux.org)
An iPhone backup audit reportedly uncovered more than 145,000 deleted photos and videos in a thumbnail cache, including sensitive images. The claim that apps with file access could read them has not been independently verified. (twitter.com)
Several PDF tools generate advertised AES-256 keys from weak randomness, making encrypted files vulnerable to passwordless decryption. MuPDF versions before 1.28.5 expose only 9 bits of random state in the key, while Foxit relies on predictable time-based randomness. (v12.sh)
Distributed Denial of Secrets published a searchable database with contact information for nearly 40,000 DHS employees, reportedly obtained through an Okta single sign-on leak. The group says the database highlights officials overseeing agency policies and operations, including immigration enforcement and covert programs. (techdirt.com)
Distributed Denial of Secrets released personal and job data on more than 40,000 DHS employees, including staff in surveillance, intelligence, and undercover roles. The group says the data came from a hack of DHS’s Okta sign-on service, but Reuters could not verify the full trove and Okta reported no evidence of a compromise. (reuters.com)
An Android user says Claude Code uncovered 14,219 front-camera and infrared face-unlock images in system and Google Play Services caches, many with timestamps and location data. The user says images kept appearing and recommends checking device backups, though the claim has not been independently verified. (twitter.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.