Leak exposes 41,000 Homeland Security staff, including ICE and CBP agents

Records on more than 41,000 employees and contractors of the US Department of Homeland Security (DHS) are now online. They include names, email addresses, phone numbers, job titles and office locations. The staff work for Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP) and other DHS agencies.

WIRED, which was given a preview of the data, reported the leak on Wednesday in a story by Dhruv Mehrotra, Maddy Varner and Dell Cameron. The transparency nonprofit Distributed Denial of Secrets (DDoSecrets) published the archive, which it calls “Icepick”, the same day.

DDoSecrets says the data came from a hacktivist group calling itself the Department of Peace, and that it was taken from the Okta single sign-on system DHS uses. Reuters could not immediately corroborate the Okta claim.

“We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised,” an Okta spokesperson told WIRED.

“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a DHS spokesperson told WIRED.

What the records show

The records run to 19 August 2026, the date of their last update. They cover about a seventh of the DHS workforce, according to WIRED’s analysis. CBP staff account for more than half. WIRED counted about 10,000 ICE records, roughly a third of them in Homeland Security Investigations (HSI), ICE’s investigative arm.

BBC News counted more than 21,000 CBP staff and nearly 6,600 at ICE. Another 6,200 records belong to US Citizenship and Immigration Services, WIRED reported. Nearly 1,000 belong to the Cybersecurity and Infrastructure Security Agency (CISA), more than half of them contractors.

WIRED found more than 55,000 permission groups in the records, which control access to internal systems. At HSI, 39 employees belong to groups whose names include “CUC”. Government court filings say that stands for “certified undercover operation”. Other group names reference a wiretap programme and appear to reference tools such as Palantir’s Falcon platform and PenLink, which analyses phone records and social media.

Some groups reference AI tools, including OpenAI’s ChatGPT, Google’s Gemini and Microsoft’s Copilot. One, called “Grok.com”, includes eight DHS technology officials. More than 200 CBP accounts sit in a group referencing Mobile Fortify, a face recognition app that immigration agents use to identify people.

Checking the data

Reuters could not immediately verify the entire trove, Raphael Satter and AJ Vicens reported. It matched personal information on six named employees to credit bureau records and breach data. It also called three employees and confirmed their phone numbers and other details. One said it was the first they had heard of a breach.

Nextgov/FCW corroborated parts of the data, including a work phone number its reporter already had, David DiMolfetta reported. It also found that some records appear to be historical, naming CISA employees who have since left.

What each side says

In a note with the files, the hackers wrote:

“They have our information, so it’s only fair that we have theirs.”

A Department of Peace spokesperson linked the leak to a remark by DHS Secretary Markwayne Mullin, in a statement released by DDoSecrets.

“On July 17th, Markwayne Mullin said he was ‘turning up the heat.’ This is what happens to ICE when you do that,” the spokesperson said.

Swiss researcher and journalist maia arson crimew, who built a search tool for the data, said the dataset provides “FOIA material for years to come”. She said on X that she was not involved in obtaining the data. Alexander Leslie, a national security expert at the threat intelligence company Recorded Future, told WIRED the data could help adversaries.

“If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS,” Leslie said.

Adam Steinbaugh, a senior attorney at the civil liberties group FIRE, spoke to WIRED about the names and basic work details in the archive.

“This is information that would be on a business card,” Steinbaugh said. “That’s not something the government can criminalize.”

Takedowns and a Bluesky block

On Thursday, crimew’s search site stopped loading after its registrar put the domain on hold, Zack Whittaker reported for TechCrunch. DHS had filed a takedown notice through ZeroFox, a security company authorised to seek the removal of data on its behalf until 2028. TechCrunch saw a copy of the notice. CentralNic, which holds the domain, did not tell TechCrunch whether it acted on a government demand.

The notice asked the registrar to “stop serving the personal contact and location data of individuals who did not consent to its publication”, according to TechCrunch.

Bluesky is blocking links to the DDoSecrets archive and labelling them “malicious”. The company told WIRED that the archive contains people’s contact information, shared without their authorisation. DDoSecrets co-founder Emma Best told TechCrunch that the dataset contains no home addresses or personal contact information. TechCrunch described the phone numbers in the data as work-issued.

The leak follows ShinyHunters’ claims about FBI data in September. Earlier this month, the FBI removed an Accenture contractor after a separate breach. This week, a suspected hacking attempt took the Federal Election Commission’s filing system offline.