Hacktivists Leak Personal Data of Over 41,000 Homeland Security Employees

A hacktivist collective operating under the name "Department of Peace" has published a searchable database containing the personal and operational records of more than 41,000 Department of Homeland Security (DHS) employees and contractors. The breach exposes roughly one-fifth of the department's 220,000-person workforce, stripping anonymity from border agents, cybersecurity personnel, and senior officials.[1][2][5]

The compromised dataset, dubbed "Icepick," includes names, job titles, work email addresses, cell phone numbers, and specific office locations. The records were shared with the transparency nonprofit Distributed Denial of Secrets (DDoSecrets) and Swiss hacker maia arson crimew, who subsequently made the archive accessible online on Wednesday.[1][5]

The leak heavily impacts the department's enforcement wings, with more than half of the exposed records—approximately 21,000—belonging to Customs and Border Protection (CBP) personnel. Another 10,000 records map to Immigration and Customs Enforcement (ICE), while 6,200 belong to Citizenship and Immigration Services and nearly 1,000 to the Cybersecurity and Infrastructure Security Agency.[1][2]

Beyond basic contact information, the database details employees' memberships in more than 55,000 internal permission groups. These group assignments provide an unprecedented map of how the DHS organizes its surveillance, intelligence, and enforcement capabilities from senior leadership down to individual field agents.[1]

The permission groups reference access to specific investigative software, including Palantir's Falcon platform, PenLink wiretap programs, and the Mobile Fortify facial recognition application. The records also show which personnel have access to enterprise artificial intelligence services, with groups tied to OpenAI's ChatGPT, Google's Gemini, Microsoft Copilot, and xAI's Grok.[1][2]

Most critically for federal law enforcement, the leak identifies officials responsible for overseeing covert programs and lists agents marked as undercover. The files reference specific certified undercover operations, including a program designated "Keyhole" that was reportedly used to monitor protest groups in Minneapolis.[1][2]

The hacktivist group claims it extracted the database from an Okta single sign-on system that the DHS uses to manage employee access across its various component agencies. Timestamps within the files indicate the records were last updated on August 19, 2026, suggesting the exfiltration occurred around that time.[1]

Okta has publicly distanced its core infrastructure from the breach, stating that it has found no evidence its own systems or data were compromised. "Okta is secure," a company spokesperson said, leaving open the possibility that the hackers compromised DHS-managed credentials rather than the broader Okta platform.[1]

The DHS acknowledged the incident on Wednesday night, confirming it is "aware of a potential breach" and is working to address the situation swiftly. "We take all security threats against our employees and officers seriously and will work to ensure all are properly protected," the agency said.[5]

The hacktivists framed the release as a direct response to recent policy shifts and the department's mass-deportation agenda. A spokesperson for the Department of Peace specifically cited DHS Secretary Markwayne Mullin's July 17 promise to escalate enforcement, stating, "This is what happens to ICE when you do that."

Emma Best, founder of DDoSecrets, defended the publication as a necessary transparency measure. "The leak is extraordinary but deceptive in its simplicity as it identifies the officials responsible for overseeing covert and undercover operations... along with key personnel in DHS's ever-escalating rendition and deportation programs," Best said.

Security experts warn that the operational detail included in the leak presents immediate risks to federal personnel. Alexander Leslie, a national security expert at Recorded Future, noted that adversaries could use the detailed reporting structures and contact information to identify vulnerable employees or compromise ongoing investigations.[1]

While First Amendment attorneys argue that publishing ordinary names and professional details is not inherently criminal, the inclusion of cell phone numbers and undercover affiliations elevates the threat level. The exposure of supervisors alongside their subordinates allows analysts to reconstruct the department's entire chain of command.[1]

The DHS has faced massive data exposures before, most notably during the 2015 Office of Personnel Management and KeyPoint Government Solutions breaches. Those incidents compromised the private background check data of as many as 390,000 current and former Homeland Security workers and contractors.

However, the 2015 breaches primarily exposed data to foreign intelligence services, whereas the Icepick archive has been published on the open internet for anyone to search. Federal authorities are now working to determine the exact method of extraction and to mitigate the fallout for the 41,000 affected personnel.[1]

The publication has prompted competing concerns about government accountability and the exposure of sensitive personnel information. As the database circulates online, the DHS faces the immediate logistical challenge of securing the communications and physical safety of thousands of field agents whose identities are no longer shielded.[1][5]