Hackers Leak Records of 41,000 DHS Personnel, Exposing Undercover ICE Agents

A leak of records covering more than 41,000 Department of Homeland Security employees and contractors has exposed contact details, work assignments, and links to sensitive operations, including undercover ICE work. Published on October 28, the archive reveals far more than a staff directory, offering a view of internal teams and reporting lines.

Distributed Denial of Secrets released the collection under the name Icepick, crediting a group calling itself Department of Peace. Researcher and journalist Maia Arson Crimew built a search tool for the records. The nonprofit says the release supports public oversight, journalism, and requests for government records.

DHS Data Leak

According to reports, the records were last updated on August 19, 2026. They include names, email addresses, phone numbers, office locations, job titles, and supervisors. The files cover DHS and seven component agencies, including Immigration and Customs Enforcement, Customs and Border Protection, and the Cybersecurity and Infrastructure Security Agency.

CBP accounts for more than half of the records, while roughly 10,000 relate to ICE. About 6,200 cover US Citizenship and Immigration Services, and nearly 1,000 concern CISA. The collection represents about one seventh of the department’s workforce, not every DHS worker.

The most sensitive details appear in more than 55,000 permission groups, which help control access to internal systems. WIRED identified 39 Homeland Security Investigations employees in groups containing “CUC,” a term government court records link to certified undercover operations. Other groups reference wiretaps, phone data analysis, and surveillance tools.

DDoSecrets says the information came from an Okta single sign-on service used by DHS. However, Reuters could not confirm that claim. Okta said its systems were secure and that it had no evidence its data or systems had been compromised. No confirmed entry method has been disclosed.

That distinction matters. A claimed theft from an organization’s identity service does not establish a breach of the identity provider itself. Separate reporting on attacks targeting Okta identity systems shows how criminals can target customer accounts through phone calls and false help desk requests. There is no confirmed link between those methods and this incident.

Reuters could not verify the entire archive. It matched details for six employees against other records and confirmed phone numbers and other information by calling three workers. Some entries matched public profiles, while others revealed internal structures or previously undisclosed operations.

Names become more useful to attackers when paired with supervisors, duties, and phone numbers. Recorded Future expert Alexander Leslie told WIRED that such information could help adversaries identify vulnerable staff, build convincing impersonation attempts, or threaten investigations. Group membership, however, should not automatically be treated as proof of a person’s current assignment.

Previous Okta support impersonation campaigns show why exposed contact details matter. Attackers have used fake support messages and login pages to steal account information and authentication codes. The DHS records could provide material for similarly tailored approaches.

The disclosure follows ShinyHunters’ September claim of stealing FBI personnel data and an October lawsuit over a Defense Department breach affecting millions. These are separate incidents, with no established common cause.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?