Leak exposes records of about 41,000 Homeland Security workers, including ICE and CBP staff

Mixed · 2The nonprofit Distributed Denial of Secrets (DDoSecrets) published an archive on Wednesday 28 October 2026 that it calls "Icepick". It holds records of about 41,000 workers at the Department of Homeland Security (DHS) and seven component agencies. 1 2 Mixed · 2A group or hacker calling itself Department of Peace says it took the data from DHS's Okta single sign-on login system. The note left with the files read: "They have our information, so it's only fair that we have theirs." 1 2 Mixed · 2The journalist and researcher maia arson crimew received the data and shared it with DDoSecrets. crimew also built a website where the records can be searched. 2 1

Mixed · 2The records include names, job titles and work contact details such as email addresses, cellphone numbers and office locations. They also hold IT and login records showing which internal systems each person can access. Wired says the files were last updated on 19 August 2026, and TechCrunch says record timestamps suggest the data was taken around mid-August. 2 1 Mixed · 2By Wired's analysis, Customs and Border Protection (CBP) staff are more than half of the records. TechCrunch puts the CBP figure at about 21,000. Both outlets say Immigration and Customs Enforcement (ICE) accounts for about 10,000 records, and that nearly 1,000 belong to the cybersecurity agency CISA. Wired adds that about 6,200 are US Citizenship and Immigration Services staff. 1 2 Left · 1Wired reports that 39 Homeland Security Investigations (HSI) employees across more than a dozen field offices belong to permission groups whose names include "CUC". Court filings say this stands for "certified undercover operation". The headline's reference to undercover agents rests on these group names. Another group references "Keyhole", a certified undercover operation that federal filings say funded HSI surveillance of Minneapolis protest groups earlier this year. 1

Mixed · 2The permission-group names also point to tools that DHS staff can reach. These include Palantir's Falcon platform, Penlink (including Penlink PLX), wiretap-related programmes, the Mobile Fortify facial-recognition app (more than 200 CBP users), and AI tools such as ChatGPT. Wired also reports a "Grok.com" group and that two groups list the same 13 people, including former DHS head Kristi Noem. TechCrunch reports a "Headspace_users" group of about 4,500 users. A Headspace spokesperson said the company has provided no services to DHS or ICE since 2023. 1 2 Mixed · 2Okta told both outlets it is unaware of any breach: "Okta is secure, and we have no evidence our data or systems were compromised." DHS did not respond to either outlet's request for comment. TechCrunch says it is unclear whether the vulnerability has been fixed or whether DHS knows of the theft. 1 2 Mixed · 2TechCrunch verified part of the data by matching the names of known DHS employees against an offline copy of the database, and says the data appears authentic. Alexander Leslie of Recorded Future told Wired that, if authentic and current, the dataset is "an extraordinarily valuable intelligence resource for those seeking to penetrate DHS". He warned that adversaries could use it to identify vulnerable personnel or build convincing impersonation attempts. 2 1

Mixed · 2Supporters of the release present it as a tool for accountability. Ryan Shapiro of Property of the People said email addresses and phone numbers are indispensable for Freedom of Information Act (FOIA) researchers. DDoSecrets co-founder Emma Best called the release a "catalyst for investigations". crimew told Wired that DHS "completely lacks accountability" and rejected the doxing label. Adam Steinbaugh of FIRE said the basic work details are "information that would be on a business card" and that the government cannot criminalise sharing them. 2 1 Mixed · 2Both outlets place the leak within a run of breaches of US government data. Wired cites the ShinyHunters claim of stolen FBI employee data, and TechCrunch also cites FBI records and Pentagon HR data. TechCrunch adds that the same hacker earlier this year claimed to have taken thousands of DHS contracts with private firms. Wired notes that DHS has pursued critics and treated publication of employees' names as "doxing", and that 15 Minnesota residents were charged in June over ICE-related activity. 2 1