The Department of Homeland Security said on Thursday it is investigating a potential breach after a hacker group published work details of more than 40,000 of its employees and contractors online, including some involved in undercover immigration enforcement operations. The leak, released on Wednesday by the transparency nonprofit Distributed Denial of Secrets under the name "Icepick," is one of the largest exposures of US federal law enforcement personnel data in recent memory, and it arrives as the Trump administration's immigration crackdown faces growing scrutiny.
What Was Exposed
According to reports from USA TODAY, Reuters and WIRED, the dataset covers people who worked for DHS and its component agencies as of August 19, 2026. It includes names, phone numbers, email addresses, office locations and job titles, along with membership in internal groups that control access to the department's computer systems.
Customs and Border Protection accounts for more than half of the records, with more than 21,000 people listed, according to reports describing the data. Immigration and Customs Enforcement accounts for thousands more, including agents in its investigative wing, Homeland Security Investigations. About 6,200 records belong to US Citizenship and Immigration Services and nearly 1,000 to the Cybersecurity and Infrastructure Security Agency, USA TODAY reported, citing WIRED's analysis. More than half of the people listed are contractors, WIRED reported.
Importantly, the release appears to contain work contact and organizational information only, not Social Security numbers or personnel files, according to WIRED's analysis of the data. That distinction matters, but security experts say the organizational detail alone is unusually revealing: the permission groups map out how the sprawling department, which employs more than 260,000 people, is structured, from senior leadership down to individual immigration agents and detention contractors.
How the Leak Emerged
The group behind the leak calls itself the Department of Peace. It says it obtained the data through DHS's single sign-on login system and passed the material to Distributed Denial of Secrets and to a Swiss hacker and journalist known as maia arson crimew, who built a searchable tool for the data.
Distributed Denial of Secrets published the archive on October 28. The group describes itself as archiving and publishing hacked and leaked documents in the public interest, and it said the searchable database would help the public better understand what the various sub-agencies within DHS are doing. Emma Best, a journalist and co-founder of the group, said the database identifies many of the architects and drivers of DHS policy and operations, including officials responsible for covert and undercover operations and for the government's deportation programs.
Crimew called the dataset "massive in terms of both size and impact" and said it provides an unprecedented look into the department's organizational structure. Best said the tool would "replace anonymity with accountability" and empower journalists, guide public records requests and boost congressional oversight.
The Washington Post confirmed the database's authenticity with current and former officials, according to secondary reporting, while Reuters said it separately corroborated some employee information through records and direct calls. Bluesky has blocked links to the archive, telling WIRED the contact details were shared without authorization.
The Undercover Details That Worry Officials
What has alarmed current and former officials most is not the phone numbers alone but the window the data opens into sensitive work. The files reference internal systems and programs, including wiretap programs and the use of Palantir software and AI chatbots, WIRED reported. The database also appears to reference tools for accessing immigration court records, pulling data from seized phones and conducting surveillance.
At Homeland Security Investigations, 39 employees across more than a dozen field offices belong to groups whose names include "CUC," which government court filings say stands for "certified undercover operation," WIRED reported. One such permission group, apparently based in HSI's St. Paul, Minnesota, area of operations, references "Keyhole," which federal court filings describe as a certified undercover operation that recently funded HSI's undercover surveillance of Minneapolis protest groups earlier this year.
Former acting ICE director John Sandweg, who served under President Barack Obama, warned that the exposure could jeopardize agents and investigations involving gangs and drug cartels. "I feel terrible for the agents and their families," Sandweg told The Washington Post, according to secondary reporting.
The leak also lands in a charged political context. Since the start of the second Trump administration, agency officials have moved to shield DHS employees' identities, allowing street agents to wear masks despite efforts by numerous states to prohibit that policy, USA TODAY noted. The administration has also prosecuted protesters for posting information about individual ICE officers: in June, 15 Minnesota residents were charged under laws related to stalking and threats of violence, which prosecutors linked to their participation in ICE-opposition activities, WIRED reported.
What DHS and Okta Say
DHS confirmed it is looking into the matter but has not confirmed the full scope of what was taken. "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively," the agency said in an October 29 statement sent to USA TODAY. "We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available."
The agency did not respond to a request for comment about its efforts to investigate the leak and prevent further exposure, USA TODAY reported.
The login provider at the center of the dispute has pushed back. Okta said in a statement to Security Week: "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised." How the group obtained the data, and how long any vulnerability may have existed before the leak became public, remain unanswered: one analysis noted timestamps pointing to mid-August.
What This Means
The DHS leak is the third major government data exposure to make headlines in the past month, Reuters noted. In September, the hacking group ShinyHunters claimed to have stolen a trove of data from the Federal Bureau of Investigation, including sensitive job details and medical information from thousands of bureau employees and their families. Last week, the Defense Department was hit with a class action lawsuit following a breach that exposed data on millions of current and former military personnel.
Taken together, the incidents point to a widening problem: the federal government's own workforce data has become a target, and the consequences fall hardest on people whose jobs depend on not being identified. For undercover agents and investigators working cartel and gang cases, the publication of names, offices and assignments is not an abstract privacy issue. It is a safety issue, and one that cannot be undone: once a dataset like this circulates, copies persist.
At the same time, the publishers frame the release as a transparency measure aimed at an agency they accuse of operating in secret. The group said it acted in response to ramped-up ICE operations, quoting DHS Secretary Markwayne Mullin's July 17 remark that he was "turning up the heat" and adding: "This is what happens to ICE when you do that."
What Happens Next
In the short term, the key questions are practical: whether DHS can confirm what was taken, whether affected employees are warned and protected, and whether any undercover operations must be changed or shut down. Lawmakers are likely to demand briefings, and the searchable database gives journalists and oversight bodies years of material to work through.
Investigators will also be tracing how the data was obtained, a process that could determine whether anyone faces criminal charges and whether other agencies using the same login systems need to act. The FBI leak and the Defense Department breach already have federal investigators and lawyers involved; the DHS case adds a third front.
For the public, the episode is a reminder of how much of the government's security apparatus runs on ordinary workplace systems: directories, login services and permission groups that were never designed to be published. The leak did not, according to WIRED's analysis, expose Social Security numbers or personnel files. But it exposed something nearly as sensitive for a law enforcement agency: who does what, where they work, and how the organization fits together.
Post a Comment