A massive data leak has exposed personal information belonging to over 41,000 Homeland Security workers, including undercover ICE agents. The records, spanning DHS and seven component agencies such as Immigration and Customs Enforcement and US Customs and Border Protection, were last updated on August 19, 2026. Transparency nonprofit Distributed Denial of Secrets and researcher maia arson crimew previewed the data to WIRED, obtaining it from a group calling itself the Department of Peace. DDo Secrets published the archive, dubbed "Icepick," on Wednesday, claiming it originates from DHS's Okta login system. The hackers stated, "They have our information, so it's only fair that we have theirs." An Okta spokesperson denied any breach, asserting the systems remain secure. The leak follows heightened government efforts since the start of the second Trump administration to hide DHS employees' identities and expand the definition of doxing to include basic public employee details. CBP staffers account for more than half of the records, with ICE comprising roughly 10,000 employees. The files reveal internal structure from senior leadership down to individual agents and contractors, exposing over 55,000 permission groups. These groups reference tools like Palantir's Falcon platform and Pen Link for surveillance. Two groups, "Executive Leadership" and "AI Access," list 13 people with web filter exceptions.
The transparency nonprofit Distributed Denial of Secrets and cybersecurity researcher and journalist maia arson crimew previewed the data to WIRED, which they say they obtained from a group calling itself the Department of Peace. DDo Secrets published the archive, which it calls "Icepick," on Wednesday. In a press release, DDo Secrets says the data is from DHS's Okta login system. In a note with the files, the hackers wrote, "They have our information, so it's only fair that we have theirs."
An Okta spokesperson tells WIRED that it is unaware of any breach of its systems. "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised," the spokesperson says. The leak comes as DHS has aggressively pursued its critics, seeking to unmask anonymous social media users, obtain customer records on protestors, and secure warrants for surveillance tools aimed at reporters. Since the start of the second Trump administration, DHS and the federal government have moved to hide DHS employees' names and faces. The agency has also expanded its definition of "doxing"—a term that typically refers to publishing someone's home address and other personal details for malicious purposes—to encompass the publication of basic facts about public employees, like their names and titles. The leak follows a breach in which a group of hackers known as Shiny Hunters claimed to have stolen personal information on nearly every FBI employee and their families. Law enforcement agencies have arrested several suspects and detained another who is alleged to be part of the group. The DHS records are searchable on a website crimew built. "I don't think we should let them scare us into not looking into them," she tells WIRED.
DHS and DOJ did not respond to WIRED's request for comment. The FBI referred WIRED's inquiry to DHS. According to a WIRED analysis of the data, CBP staffers account for more than half of the records. ICE accounts for about 10,000, roughly a third of them in Homeland Security Investigations, ICE's investigative wing. Another 6,200 belong to US Citizenship and Immigration Services, and nearly 1,000 are tied to the Cybersecurity and Infrastructure Security Agency, more than half of them contractors. Altogether, the files cover about a seventh of DHS's workforce, revealing how DHS is structured, from senior leadership down to individual immigration agents and detention contractors. Like most large organizations, DHS uses permission groups to control access to internal systems, according to the leaked records. Nearly everyone named in the leak has access to at least some of these systems. At HSI, 39 employees across more than a dozen field offices belong to groups whose names include "CUC," which government court filings say stands for "certified undercover operation." Another group, apparently based in HSI's St. Paul, Minnesota area of operations, references "Keyhole," which federal court filings describe as a certified undercover operation that recently funded HSI's undercover surveillance of Minneapolis protest groups earlier this year. Others reference a "Communications Intercept Center Tech Ops (CICT O) Program," a "Title III Intercept Program" for wiretaps, and an "Illicit Sensor Intercept Program (ISIP)." The names of the groups—there are over 55,000 in all—appear to reference tools for accessing immigration court records, pulling data from seized phones, and conducting surveillance. These include Palantir's Falcon investigative platform and Pen Link, which analyzes phone records and social media.
Source: Hacker News · Summarized by HeadlinesBriefing