Massive leak of more than 41,000 DHS personnel records has exposed names, contact details, organizational structure, and links to undercover and surveillance programs at ICE, CBP, and other agencies.
On or around October 28–29, 2026, the transparency nonprofit Distributed Denial of Secrets (DDoSecrets), working with cybersecurity researcher and journalist maia arson crimew, published a searchable archive of records covering roughly 41,000–41,191 current and former Department of Homeland Security (DHS) employees and contractors.
The dataset, dubbed “Icepick,” draws from material obtained by a hacktivist group calling itself the Department of Peace. The group claimed it accessed the data through DHS’s Okta single sign-on system used for internal logins. Okta has stated it has no evidence its systems were compromised.
The records—last updated around August 19, 2026 include employee names, work email addresses, phone numbers (including cell numbers in many cases), office locations and addresses, job titles, assignments, supervisors, and membership in tens of thousands of internal permission groups that control access to systems and tools.
These groups reference wiretap programs such as Title III Intercept and Communications Intercept Center TechOps, undercover operations, digital forensics tools, immigration court records access, phone and social-media analysis software including PenLink, and platforms such as Palantir’s Falcon.
Some groups also reference AI tools, including OpenAI’s ChatGPT, Google’s Gemini, Microsoft’s Copilot, and a “Grok.com” group tied to a small number of DHS technology officials.
Scale and Composition
Analyses of the data show Customs and Border Protection (CBP) accounting for the largest share—more than half the records, or over 21,000 entries in some counts.
Immigration and Customs Enforcement (ICE) accounts for roughly 6,600–10,000 records (figures vary slightly across reports), with a substantial portion linked to Homeland Security Investigations (HSI), ICE’s investigative arm.
U.S. Citizenship and Immigration Services (USCIS) accounts for about 6,200 records, and the Cybersecurity and Infrastructure Security Agency (CISA) for nearly 1,000 (more than half contractors in some tallies).
Smaller numbers cover DHS headquarters, Federal Protective Service, Federal Law Enforcement Training Centers, and other components. Overall, the leak covers roughly one-seventh of DHS’s workforce and provides an unusually detailed map of structure, reporting lines, and operational groupings from senior leadership down to field agents and contractors.
Particularly sensitive elements include groups labeled with “CUC” (interpreted via court filings as “certified undercover operation”), with dozens of HSI employees across multiple field offices listed.
Other groups reference specific operations (one tied to undercover surveillance activity in the Minneapolis area) and tools used in investigations.
The data also reflects recent hiring surges, with roughly 1,300 ICE enforcement accounts created after mid-2025 legislation that funded thousands of additional Enforcement and Removal officers.
Some entries appear linked to local law enforcement partners under 287(g) agreements, detention contractors, military or National Guard support roles, and “associates” in supporting positions.
Motives and Context
The Department of Peace framed the release as a response to intensified immigration enforcement under the Trump administration and DHS Secretary Markwayne Mullin, citing Mullin’s earlier comments about “turning up the heat.”
In notes accompanying the material, the group wrote along the lines of “They have our information, so it’s only fair that we have theirs.”
DDoSecrets co-founder Emma Best described the dataset as identifying “many of the architects and drivers of DHS policy and operations,” including officials overseeing covert and undercover work, investigations into leaks, and deportation/rendition-related programs, rather than a complete indiscriminate directory of every employee.
Crimew has described the release as an accountability measure, arguing that opacity around DHS roles heightens the need for public visibility.
The leak occurs amid heightened tensions over immigration enforcement, efforts by DHS and related agencies to limit public identification of officers including debates over masks and name visibility, and prior actions targeting online critics or protesters.
It is at least the third significant compromise or disclosure of sensitive U.S. government personnel information in roughly a month, following a separate breach involving FBI-related data claimed by the group ShinyHunters.
Official Response and Risks
DHS has acknowledged awareness of a “potential breach” and stated it is working to address the situation, protect employees and officers, and will provide updates.
Internal communications have urged staff to enroll in available cybersecurity and anti-doxxing resources. Takedown efforts targeted the searchable Icepick site; it temporarily went offline before reappearing under different hosting arrangements.
Hosting providers have pushed back in some cases, characterizing much of the material as work-related contact and organizational data rather than purely private personal information.
Security experts have noted the intelligence value of the dataset. Correlated with other open or previously compromised information, the combination of identities, office locations, supervisors, and system-access groups could aid targeting of personnel, social engineering, or mapping of sensitive programs.
At the same time, civil-liberties observers have pointed out that basic work contact details and titles for public employees are often treated as non-private in other contexts, and have criticized expansive interpretations of laws against sharing restricted personal information about officers.
The Icepick archive remains a point of contention: publishers present it as a transparency and research tool for understanding DHS structure and operations, while the department and its components treat the exposure of officer identities and operational linkages as a security and safety risk.
Further official statements, forensic details on how the data was obtained, and any protective or investigative follow-up are expected as the situation develops.
