Personal and work details of more than 41,000 employees of the United States Department of Homeland Security (DHS) were published online on 28 October, in one of the largest exposures of American federal law-enforcement personnel data in recent years. The database, dubbed "Icepick", covers staff across immigration enforcement, border protection, cybersecurity and citizenship services — and, according to the reports, includes people working in undercover operations.
The leak was released by Distributed Denial of Secrets (DDoSecrets), a non-profit that publishes leaked datasets, which said it received the material from a hacking group calling itself the "Department of Peace". The group said it obtained the data through Okta, the identity and access-management service DHS uses for single sign-on — a claim Okta has disputed, saying it has found no evidence that its systems were compromised.
What was exposed
According to DW, the leaked information includes names, phone numbers, email addresses, job titles and office locations of personnel across several DHS agencies. Reporting by Reuters and TechCrunch adds that the records also contain email groups and work assignments — the kind of detail that maps out teams, chains of command and who does what inside the department.
The scale is striking. DHS employs roughly 220,000 people, so the leak covers about one in five of its workforce. More than 21,000 of the records concern Customs and Border Protection (CBP) staff. Immigration and Customs Enforcement (ICE) accounts for roughly 6,600 records on its own, or about 10,000 when its Homeland Security Investigations arm is counted alongside it. The remainder spans the Cybersecurity and Infrastructure Security Agency (CISA), US Citizenship and Immigration Services (USCIS), the Federal Protective Service and department headquarters.
Crucially, no outlet has reported that passwords, Social Security numbers or home addresses were included. That matters, but it does not make the leak harmless: a name tied to a job title, a work phone number and a specific assignment is a ready-made profile for doxxing, impersonation, spear-phishing and physical targeting — particularly for officers whose work is meant to stay low-profile.
Why this leak is different
DHS has spent considerable effort shielding the identities of its immigration and border officers, as enforcement operations have become a focus of intense public and political confrontation. The "Icepick" release cuts directly against that effort. According to the reports, job titles and email groups in the data reveal which staff work in undercover operations, surveillance and computer forensics — roles where anonymity is itself a safety measure.
The dataset reportedly goes beyond personnel files. It is said to name dozens of previously undisclosed law-enforcement campaigns and to describe surveillance tools available to DHS units, including the facial-recognition application Mobile Fortify and PenLink, a system that collects and analyses data from phones and online services. Emma Best, co-founder of DDoSecrets, said publication was intended to promote accountability and to clarify the roles of officials in secret campaigns and deportation operations.
The group behind the leak has been blunt about its motive: opposition to the Trump administration's immigration policies. In a statement quoted by several outlets, the hacker said: "They have our information, so it's only fair that we have theirs."
How authentic is the data?
Verification so far is partial but notable. Reuters reported that it matched six named employees in the dataset against credit-bureau and breach records, and that three employees it contacted confirmed their phone numbers and other details — one of them saying it was the first they had heard of any breach. TechCrunch assessed that the data "appears authentic". Reuters also stressed that it could not verify the whole dataset.
What remains unproven is how the data left the department. The "Department of Peace" claims it came through Okta's single sign-on system, but Okta says it has no evidence of a compromise of its data or infrastructure, and no court filing, indictment or technical disclosure from DHS has yet established the entry point. Until one does, the Okta claim is an assertion by the leakers, not a finding.
DHS has acknowledged the reports. A spokesperson said the agency was aware of a potential breach and was working to address it, adding that threats against employees and officers were taken seriously and that the public would be updated when more information became available.
Part of a pattern
The DHS leak does not stand alone. It follows closely on a separate incident in which hackers obtained data on FBI employees and job applicants, and it lands in a year when public institutions have repeatedly discovered that their internal directories are softer targets than their classified systems. A directory may look boring — names, emails, office locations — but aggregated at the scale of 41,000 people, it becomes an organisational chart of one of the world's largest law-enforcement departments, handed to anyone with an internet connection.
That is the same lesson visible in other recent breaches, from court systems to corporate networks: the most damaging leaks are not always the ones that steal secrets. Sometimes they simply publish who works where, doing what — and let others draw the rest of the map. For an agency whose officers increasingly operate in the open, under cameras and public scrutiny, the exposure of undercover and surveillance staff is the sharpest edge of this release.
The episode also sharpens a question that will follow DHS into the months ahead: whether its identity and access systems — the single sign-on gateways that let tens of thousands of staff into internal platforms — are governed with the same rigour as the operations they protect. The department has promised updates; the credibility of those updates will rest on whether it can say, concretely, how the data got out and what has changed to stop it happening again.
For related coverage, see our report on the Arizona court cyberattack and the FBI's seizure of Chinese hacker tools.
Frequently Asked Questions
What is the 'Icepick' leak?
'Icepick' is the name given to a database of more than 41,000 Department of Homeland Security employee records, published on 28 October 2026 by the non-profit Distributed Denial of Secrets after it received the material from a hacking group calling itself the "Department of Peace".
Whose information was exposed?
Staff across DHS, including more than 21,000 Customs and Border Protection employees and several thousand Immigration and Customs Enforcement staff, plus personnel from CISA, USCIS, Homeland Security Investigations and the Federal Protective Service. The records reportedly include names, job titles, work emails, phone numbers, office locations and work assignments.
Were passwords or Social Security numbers leaked?
No outlet has reported passwords, Social Security numbers or home addresses in the dataset. The risk comes from the combination of the fields that were exposed, which can enable doxxing, impersonation, phishing and targeting of officers.
How did the hackers claim to get the data?
The group said it accessed the information through Okta, the single sign-on service DHS uses. Okta has said it found no evidence that its systems were compromised, and the entry point has not been independently confirmed.
Has DHS responded?
A DHS spokesperson said the agency was aware of a potential breach, was working to address it, and took threats against employees and officers seriously, with further updates promised when more information becomes available.
