Data Leak Exposes Records of Over 41,000 Department of Homeland Security Employees

A massive data breach has exposed the personal and professional details of more than 41,000 Department of Homeland Security employees and contractors. The leaked archive, dubbed "Icepick," surfaced online after being released by a group calling itself the Department of Peace. Transparency nonprofit Distributed Denial of Secrets hosted the records, and Swiss cybersecurity researcher and journalist maia arson crimew developed a public search tool to browse the database.

The exposed files provide an unusually detailed view of the agency's internal structure. The dataset includes names, telephone numbers, work email addresses, and office locations for personnel across multiple branches, including Immigration and Customs Enforcement, U.S. Customs and Border Protection, Homeland Security Investigations, and the Cybersecurity and Infrastructure Security Agency. Notably, the disclosures reveal specific job assignments, unmasking agents involved in sensitive duties such as undercover work, surveillance programs, computer forensics, and human intelligence.

Reports vary regarding the precise breakdown of the personnel contained in the archive. While some analyses indicate that more than 21,000 of the compromised records belong to Customs and Border Protection staff and approximately 6,600 to Immigration and Customs Enforcement workers, other tallies show around 10,000 ICE accounts alongside 6,200 from U.S. Citizenship and Immigration Services and roughly 1,000 from the Cybersecurity and Infrastructure Security Agency.

Beyond personnel files, the leaked material sheds light on nonpublic operations and technical infrastructure used by federal agents. Documents reference internal initiatives such as "Keyhole," an undercover surveillance operation targeting protest groups in Minneapolis earlier this year. The cache also details wiretapping and communications monitoring frameworks, including the Communications Intercept Center TechOps Program, a Title III Intercept Program, and an Illicit Sensor Intercept Program. Additionally, the leak details specialized investigative software utilized by staff, such as Palantir's Falcon platform, PenLink's communication analysis software, and artificial intelligence tools including OpenAI's ChatGPT, Google's Gemini, and Microsoft's Copilot.

The Department of Peace claimed it executed the leak in response to escalating federal enforcement. In an accompanying statement, the group asserted, "They have our information, so it's only fair that we have theirs," pointing specifically to remarks by Homeland Security Secretary Markwayne Mullin on July 17 that immigration authorities would be "turning up the heat" with increased arrests and traffic stops. Distributed Denial of Secrets co-founder Emma Best said the publication was intended to replace "anonymity with accountability," asserting that making the structure visible would aid journalists, enhance congressional oversight, and guide public records requests.

Questions remain regarding how the unauthorized data collection was accomplished. Distributed Denial of Secrets said the hackers harvested the records from the Okta single sign-on system utilized by the Department of Homeland Security. However, an Okta spokesperson disputed that the company's infrastructure was compromised, stating: "Okta is secure, and we have no evidence our data or systems were compromised." Independent reporting by Reuters corroborated several individual employee listings against credit bureau files and confirmed accurate phone numbers with three DHS employees directly, one of whom noted it was their first notice of a breach.

In response to the incident, a Department of Homeland Security spokesperson stated that the agency is "aware of a potential breach and is actively working to address the situation swiftly and effectively." The department added, "We take all security threats against our employees and officers seriously and will work to ensure all are properly protected," promising to provide further updates as more information emerges.

The incident marks the third high-profile federal government data controversy to emerge within weeks. In September, the hacking collective ShinyHunters claimed responsibility for stealing employee records and medical files from the Federal Bureau of Investigation, and the Department of Defense was recently named in a class-action lawsuit following a separate breach affecting millions of current and former military service members.