The terse sentence captured a fast-moving dispute over control of a searchable archive called Icepick: a database that hacktivists say contains records for more than 41,000 Department of Homeland Security employees. The search tool briefly went offline, then returned under a different registrar, after a takedown request from a DHS contractor and a refusal by the Icelandic host to comply.
Icepick archive: scale and availability
Hacktivists posted what they said was a breached DHS database containing work-related records for more than 41,000 employees, and published a searchable interface called Icepick. The tool — referenced as icepi.cx in public messages — was accessible online until mid-morning on the day of the dispute, when registrant and registrar actions caused it to stop resolving. According to FlokiNET, the site later came back online under a different registrar.
ZeroFox takedown request, CentralNic action, and FlokiNET’s refusal
FlokiNET said it received a takedown request from ZeroFox, identified in reporting as a Department of Homeland Security contractor, asking that the host remove the data. FlokiNET refused that request, writing that the submission mischaracterized the archive as doxxing and arguing the records were work identities rather than private information. Separately, the domain icepi.cx was placed on serverHold by CentralNic, which caused the site to stop resolving; FlokiNET described that registrar action as the decisive factor in taking the site down for a global audience.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCompeting legal and public-interest arguments
FlokiNET framed its refusal as a public-interest decision. "Doxxing publishes private details about private people so that others can find them at home. Icepick publishes work identities of government employees," the company wrote. "Who they work for. What their role is. How they can be reached in that role. The information describes people in the exercise of public authority, not in their private lives."
FlokiNET added: "The public has a legitimate interest in knowing who is doing that work, under whose authority, and in which office. Journalists cannot report on an agency whose personnel are structurally unknowable." That stance clashed with ZeroFox’s argument to FlokiNET, which emphasized the origin and sensitivity of the content: "The request does not depend on who the listed individuals are or what their duties are," ZeroFox wrote. "It rests on two facts: the data was stolen, and it is personal data that identifies and locates real people."
Bluesky and platform moderation
The social-media platform Bluesky also took steps that limited distribution of the archive: it blocked links to Icepick because, according to reporting, the archive shared people’s contact information without their permission. A Bluesky company official told reporters that changes were coming because the wording had identified the archive as a malicious link. The reporting did not quote the official beyond that point, but noted the platform-level blocking alongside the registrar-host dispute.
DHS statement and immediate stakeholders — journalists, DHS employees, registrars
The Department of Homeland Security acknowledged the issue in a brief statement: "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively," a spokesperson said. "We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available."
- Journalists and editors: FlokiNET explicitly framed the archive as material of public interest and argued that reporters need access to workforce data to hold agencies to account; that argument was central to FlokiNET’s refusal to remove the site.
- DHS employees named in the archive: DHS has said it is working to protect employees after the potential breach; ZeroFox’s takedown case emphasized that the data is stolen and can identify and locate real people.
- Registrars and hosting providers: the episode demonstrates how different actors in the domain ecosystem can produce opposite outcomes — CentralNic’s serverHold took the site offline while FlokiNET’s refusal to remove content kept its servers hosting the files, and the site later reappeared under a different registrar.
The facts on the table show a stark, procedural tug-of-war: an archive claimed to hold more than 41,000 employee records, a contractor pressing for removal on the grounds the data was stolen and identified people, a host asserting a public-interest rationale for keeping material online, and a registrar stepping in to suspend a domain. DHS says it is addressing the breach and will provide updates; the public-facing tools that made those records searchable have been alternately reachable and blocked.
The collision of competing priorities — safety and confidentiality argued by ZeroFox, transparency and public accountability argued by FlokiNET, and moderation choices by platforms such as Bluesky — leaves a narrow set of concrete, immediate questions: which technical or legal pathway will produce a durable resolution for the records, and how will DHS follow up to protect affected employees? The agency's pledge to update the public is the next checkpoint for answers.
