FlokiNET rejected a ZeroFox request on behalf of the Department of Homeland Security (DHS) to remove an employee directory after the firm warned publication could put more than 40,000 people at risk.
In a letter FlokiNET posted Oct. 29, ZeroFox said the archive could expose more than 40,000 identifiable people to intimidation, unwanted pursuit or physical danger. FlokiNET, an Icelandic hosting company, said it declined, maintaining that the directory sheds light on employees’ duties and work locations.
Distributed Denial of Secrets (DDoSecrets) published Icepick on Oct. 28. It says it received the records from an organization calling itself the Department of Peace and attributes them to a DHS Okta single sign-on service. The group says the directory contains names, offices, contact details and assignments for more than 41,000 employees. EconoTimes previously covered DDoSecrets’ publication of the Icepick archive.
A DHS spokesperson said the department was aware of a potential breach and was working to address it, CyberScoop reported. An Okta spokesperson said the company had found no evidence its data or systems were compromised, WIRED reported.
WIRED reported that its review found records spanning DHS and seven component agencies, with references to internal systems and agency operations; it said the collection was last updated Aug. 19, 2026. Reuters said it could not authenticate the full collection. Its checks found matching information for about six employees, and three people it contacted confirmed phone numbers and other details.
In a statement reproduced by DDoSecrets, the Department of Peace framed the release as a response to a July 17 remark by DHS Secretary Markwayne Mullin. That was the group’s stated motive.
Okta provides identity and access software. Its fiscal 2026 filing describes single sign-on as a central login for applications hosted online or on local systems. The system lets a user reach multiple applications after signing in once.
