On Wednesday, transparency group Distributed Denial of Secrets (DDoSecrets) published an archive identifying more than 41,000 Department of Homeland Security (DHS) staff and contractors from an internal Okta login directory. A hacktivist collective known as the Department of Peace provided the files to DDoSecrets and independent researcher maia arson crimew [1]. The archive, which activists call “Icepick,” was last updated on August 19, 2026, and spans seven component agencies including Immigration and Customs Enforcement (ICE) and US Customs and Border Protection (CBP) [2]. The records cover about a seventh of the department’s total workforce. The release amounts to a major DHS data leak exposing reporting hierarchies and undercover programs, but Okta said that its own systems showed no evidence of compromise [3].
What the DHS Data Leak Covers
Customs and Border Protection staff account for more than half of the exposed records. Immigration and Customs Enforcement accounts for about 10,000 records, with roughly a third of those personnel assigned to Homeland Security Investigations (HSI), the agency’s investigative arm. Another 6,200 records belong to US Citizenship and Immigration Services (USCIS). The Cybersecurity and Infrastructure Security Agency (CISA) has nearly 1,000 accounts in the leak, and more than half of those belong to outside contractors [3].
Contractors and support staff make up a large share of the directory. The files include roughly 4,400 associates, a broad personnel category that covers data scientists, software developers, nurses, and detention guards stationed at various federal facilities. Among those accounts, 145 individuals are labeled as a “contractor” or “high risk contractor” [3]. Most entries list an office location, contact phone number, and supervisor [1]. Because supervisors appear beside staff names, researchers can reconstruct full lines of command across seven component agencies without filing Freedom of Information Act (FOIA) requests. More than 300 entries reference senior headquarters positions [3].
The activists who released the files described their project as a push for public oversight [1]. In a statement published with the archive, the hackers wrote, “They have our information, so it’s only fair that we have theirs” [2]. Crimew built an online search tool to make the files easier to search, saying the data simplifies the identification of agents and lines of command while providing valuable FOIA material for years to come. The records also reveal the specific internal software tools that employees may access [1].
Undercover Operations
Homeland Security uses more than 55,000 permission groups to control access to government databases. At HSI, 39 staff members belong to groups that carry the label “CUC,” an abbreviation that federal court filings identify as a certified undercover operation. Those agents work in more than a dozen field offices. Another group references Keyhole, an operation based in the St. Paul area that funded undercover spying on Minneapolis protest groups earlier this year while drawing support from HSI operatives. The files also list accounts assigned to a Title III wiretap program, the Illicit Sensor Intercept Program, and the Communications Intercept Center TechOps Program. CUC stands for certified undercover operation [3].
The database outlines access to investigative software and commercial tracking tools, including Palantir Falcon for case analysis and PenLink for reviewing phone records and social media accounts. More than 700 accounts belong to a group referencing the encrypted messaging app Signal, and almost all of them connect to CBP staff. Another 200 CBP accounts connect to Mobile Fortify, a facial recognition tool that field agents use to identify people. About half of those accounts are in Texas, California, and Arizona [3].
Threat intelligence expert Alexander Leslie of Recorded Future said this detailed software mapping creates serious risks for federal staff. “If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS,” Leslie said in an interview with WIRED. Leslie warned that foreign adversaries could match the names against earlier data breaches. “An adversary could spend months exploiting these relationships to identify vulnerable personnel, develop convincing impersonation attempts, or compromise ongoing investigations,” Leslie said [3].
Political Appointees
The archive details web filter exemptions granted to high-ranking officials and political appointees. Two permission groups titled “Executive Leadership” and “AI Access” contain the same thirteen individuals, allowing them to bypass standard website blocks. Both groups list thirteen people. The roster includes former DHS head Kristi Noem and Antoine McCord, a former chief information officer who recently returned to defense tech firm Anduril. Philip Hegseth, a senior adviser to the DHS secretary and younger brother of defense secretary Pete Hegseth, appears beside policy adviser Jayce Krachenfels, who previously worked as a 2024 campaign field director for Donald Trump. None of the four responded to requests for comment [3].
Artificial intelligence software accounts also appear in the directory. A group called Grok.com includes eight technology officials, among them the agency’s former chief information officer and chief data officer. Other groups reference OpenAI’s ChatGPT, Google’s Gemini, and Microsoft’s Copilot. Federal security disclosures differ from consumer software incidents like the OpenAI agents user image leak, because the DHS files expose government workplace rosters, tactical assignments, and supervisor reporting lines. The agency maintains specific review policies for these tools [3].
Enforcement initiatives have expanded the department’s active roster. Roughly 1,300 ICE enforcement accounts were created after July 4, 2025, when Trump signed the One Big Beautiful Bill Act to fund 10,000 new officers. The leak also details military roles. About 170 accounts provide military processing support at ICE facilities, and 35 identify National Guard members. Nearly 20 accounts belong to Department of Defense staff, including eight in a unit labeled “ICE Tip Line DOW Surge”. Dozens of local officers carry titles like “Designated Immigration Officer” or “287(g) Officer,” linking county jails to ICE systems [3].
DHS Data Leak Repercussions
Efforts to share the leaked directory online quickly ran into technical obstacles. Researcher maia arson crimew built an online search tool at icepi.cx to help journalists examine the records, but the domain registrar took the site offline within hours. Meanwhile, social media network Bluesky began blocking links to the archive and labeled them as malicious. DDoSecrets responded by publishing the raw source code for the search tool so anyone could run it locally. The data remains available through decentralized networks [1].
The hacktivists framed the release as political pushback. A spokesperson for the Department of Peace cited comments from an Oklahoma lawmaker on the DDoSecrets website. The collective highlighted July 17 remarks by Senator Markwayne Mullin about turning up heat on enforcement, claiming their release showed the consequences of such pressure on ICE. The statement connected the publication of employee rosters to political speeches about immigration enforcement. The collective has not disclosed how it got the files [1].
The incident follows a similar leak in September, when the hacking collective ShinyHunters distributed personal files for roughly 5,000 FBI personnel, including home addresses, phone numbers, and emergency contacts to several news outlets as reported by The New York Times. ShinyHunters addressed their public statement directly to FBI Director Kash Patel and Brett Leatherman, the bureau’s cyber division chief. DHS acknowledged the new leak. “DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” said a department spokesperson. The agency added that it takes threats against staff seriously [1].
Debate Over Public Records
The leak comes amid a federal push to conceal the identities of immigration personnel. Agencies have tried to hide employee names and faces while expanding their definition of doxing to cover basic facts about public workers, including job titles and work email addresses. In June, prosecutors charged fifteen Minnesota residents under stalking and threat laws after they protested against ICE operations. That prosecution followed a surveillance operation involving more than 100 HSI agents who monitored protest group chats. Government officials argue that publishing officer rosters endangers field agents [3].
Civil liberties advocates say that publishing public employee names does not violate federal law. Adam Steinbaugh, a senior attorney at the civil liberties group FIRE, said the government can’t punish the release of routine work details under federal officer protection laws. “This is information that would be on a business card,” Steinbaugh said. “That’s not something the government can criminalize.” Steinbaugh pointed to federal statute 18 USC 119, arguing that the law was never intended to hide the identities of public servants from taxpayers [3].
The creators of Icepick reject claims that sharing the employee directory is harassment. “The DHS especially as an agency completely lacks accountability, despite many parts of it being incredibly unpopular,” crimew said. Crimew said some employees describe their work on LinkedIn as merely “stuff at US Government”. “I don’t think we should let them scare us into not looking into them,” she said [3].
- ONLINE NEWS Gil, B. (2026, October 29). Data from more than 41,000 DHS workers exposed in massive leak. Gizmodo. [Article Link]
- ONLINE NEWS Ars Technica. (2026, October). Massive leak exposes 41,000 DHS workers and undercover ICE agents. [Article Link]
- ONLINE NEWS Mehrotra, D., Varner, M., & Cameron, D. (2026, October 28). Massive leak exposes 41,000 Homeland Security workers—including undercover ICE agents. WIRED. [Article Link]
