A massive leak of Department of Homeland Security records has exposed details about more than 41,000 employees and contractors, including people connected to undercover work, surveillance programs, and sensitive internal systems. The files include email addresses, phone numbers, office locations, managers, job titles, and group memberships.
Distributed Denial of Secrets published the archive on Wednesday under the name “Icepick.” The records were last updated on August 19, 2026, and are searchable through a website built by cybersecurity researcher and journalist maia arson crimew. The database covers DHS and seven component agencies, including Immigration and Customs Enforcement, US Customs and Border Protection, US Citizenship and Immigration Services, and the Cybersecurity and Infrastructure Security Agency.
The data was allegedly taken from an Okta single sign-on service used by DHS. Okta said it was unaware of any breach involving its systems. “Okta is secure, and we have no evidence our data or systems were compromised,” an Okta spokesperson said.
What the database reveals
A review of the records found that CBP staff account for more than half of the entries. ICE accounts for about 10,000, with roughly a third of those tied to Homeland Security Investigations, ICE’s investigative wing. Another 6,200 records belong to USCIS, while nearly 1,000 are connected to CISA, more than half of them contractors.
Altogether, the files cover about a seventh of DHS’s workforce. DDoSecrets said the archive is not a complete list of every DHS employee. Cofounder Emma Best described it as a collection that identifies “many of the architects and drivers of DHS policy and operations.”
The records also show how DHS organizes access to its internal systems. Like most large organizations, the department uses permission groups to control access, and nearly everyone named in the leak appears to have access to at least some internal systems. More than 55,000 group names appear in the records, with references to immigration court systems, seized-phone data, surveillance tools, and investigative platforms.
Some groups reference Palantir’s Falcon investigative platform and PenLink, which analyzes phone records and social media. Others mention the Communications Intercept Center TechOps Program, a Title III Intercept Program for wiretaps, and the Illicit Sensor Intercept Program.
The database also contains groups tied to xAI’s Grok chatbot, Signal, Mobile Fortify, and other systems. Two groups named “Executive Leadership” and “AI Access” appear to list people who received exceptions to DHS’s web filter, which blocks some websites for employees. Both groups contain the same 13 people, including former DHS head Kristi Noem.
Undercover operations and security concerns
The leak has drawn attention because some records appear linked to undercover investigations. At HSI, 39 employees across more than a dozen field offices belong to groups containing “CUC,” which court filings describe as shorthand for “certified undercover operation.”
Another group, apparently tied to HSI’s St. Paul, Minnesota, area of operations, references “Keyhole.” Federal court filings describe Keyhole as a certified undercover operation that recently funded HSI’s undercover surveillance of Minneapolis protest groups earlier this year.
The records include ICE and CBP facility locations, workers’ cell phone numbers, and members of groups connected to wiretap programs and investigative software. Alexander Leslie, a national security expert at Recorded Future, said the information could help people seeking to penetrate DHS identify personnel, build impersonation attempts, or compromise investigations.
“This dataset becomes way more valuable when correlated with previously compromised information, commercial data, and other intelligence collections,” Leslie said.
The Homeland Security spokesperson said DHS is aware of a potential breach and is working to address it. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected,” the spokesperson said. DHS also said it would update the public when more information becomes available.
A leak during a wider fight over government secrecy
The disclosure arrives as DHS has pursued critics, sought to unmask anonymous social media users, requested customer records on protesters, and pursued warrants for surveillance tools aimed at reporters. Since the start of Donald Trump’s second administration, DHS and the federal government have also moved to hide employees’ names and faces.
The agency expanded its definition of “doxing” to include publishing basic facts about public employees, such as their names and titles. The hackers included a short explanation with the files: “They have our information, so it’s only fair that we have theirs.”
The group calling itself the Department of Peace said the leak responded to DHS Secretary Markwayne Mullin’s statement on July 17 that ICE would be “turning up the heat on the streets” by intensifying immigration arrests and traffic stops. DHS completed 980,000 deportations during the first 18 months of his term, according to the Migration Policy Institute, while ICE arrested 49,571 people in July 2026, its highest monthly total during Trump’s second term.
The Department of Peace previously leaked 6,000 DHS and ICE contracts in March involving private universities and businesses, including Palantir, Microsoft, Oracle, and Anduril. The latest disclosure follows a separate breach in which ShinyHunters claimed to have stolen personal information on nearly every FBI employee and their families. Law enforcement agencies have arrested several suspects and detained another person alleged to be part of the group.
DDoSecrets described Icepick as a tool for investigations, legal challenges, Congressional inquiries, community action, and Freedom of Information Act requests. Emma Best called the records a way of “replacing the regime’s anonymity with accountability.”
The Department of Justice did not respond to a request for comment, while the FBI referred questions to DHS. The full scope of the breach remains unclear, but the searchable records have already exposed a detailed view of the department’s personnel, command links, systems, and operations.
Based on
- Massive leak exposes 41,000 DHS workers and undercover ICE agents — arstechnica.com
- Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents | WIRED — wired.com
- U.S. DHS officials’ details apparently exposed in massive data breach — cnbc.com
- Non-profit group leaks data of more than 40,000 homeland security workers | Trump administration | The Guardian — theguardian.com
- Hacker collective leaks DHS employee records — thehill.com
