Personnel records on tens of thousands of US Department of Homeland Security (DHS) employees and contractors were published on Wednesday by the transparency nonprofit Distributed Denial of Secrets (DDoSecrets). Reported totals run from "more than 40,000" (TechCrunch and Reuters) to "more than 41,000" (WIRED). The archive, which DDoSecrets calls "Icepick", includes names, job titles, cellphone numbers, office locations and internal email group memberships. Those memberships identify staff in surveillance, wiretap-related, computer forensics and undercover roles at Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP) and other DHS agencies. A group calling itself the "Department of Peace" has claimed the theft. DHS did not respond to requests for comment from Reuters or Straight Arrow News, and it has not made any public statement or published a breach notification.
What Happened
DDoSecrets released the archive on October 28, 2026. It had previously shared the data with WIRED, TechCrunch, Straight Arrow News and L.A. TACO. The data was previewed together with the Swiss researcher and hacktivist maia arson crimew. Reuters reports that crimew also built a public search tool for it. DDoSecrets co-founder Emma Best said the tool would "replace anonymity with accountability" and would help journalists, public records requests and congressional oversight.
Both DDoSecrets and the outlets say the data came from the Department of Peace. A note left with the files reads: "They have our information, so it's only fair that we have theirs." In a press release sent to L.A. TACO, a spokesperson for the source tied the leak to political events. The spokesperson cited a July 17 remark by Senator Markwayne Mullin about "turning up the heat" on DHS critics. The hackers did not respond to questions from TechCrunch or Reuters about how they got in.
WIRED reports that the records were last updated on August 19, 2026, and cover DHS headquarters plus seven component agencies. TechCrunch calls it a "previously undisclosed breach" from earlier this year. No source has established when the intrusion began, when it ended, or whether DHS knew about it before publication.
Two other recent incidents give context, though no reporting links them to this leak:
- HSIN audit. Nextgov/FCW reported on October 8 that the Government Accountability Office (GAO) is auditing three security incidents on the Homeland Security Information Network (HSIN) between 2023 and 2026. One was a summer 2026 intrusion by outside hackers whose affiliation is unknown. GAO is also expected to criticise DHS for slow notification to Congress. No outlet has tied that intrusion to the Icepick data, and the claimed source here is a different system (Okta).
- Other federal personnel breaches. Reuters calls this the third major government personnel leak in a month. In September, ShinyHunters claimed it stole FBI employee data. Separately, the Pentagon's Defense Manpower Data Center (DMDC) disclosed a breach affecting about 3 million people. BleepingComputer and Nextgov/FCW report that it went undetected from October 2025 until July 16, 2026.
What Was Taken
Across the reporting, the dataset includes:
- Identity and contact data: names, job titles, work email addresses, cellphone numbers and office locations (TechCrunch, Reuters, WIRED).
- Organisational structure: each employee's manager, which lets users trace chains of command (L.A. TACO), and what WIRED calls "a map of how DHS is organized and how it operates."
- Facility locations: addresses of hundreds of DHS, ICE and CBP offices and facilities (WIRED, L.A. TACO).
- Sensitive group memberships: email and access groups showing who works in special operations, surveillance, computer forensics and undercover work (Reuters), plus groups tied to wiretap programs, Palantir software and xAI's Grok chatbot (WIRED).
- Identity system records: TechCrunch reports that the data includes IT and login details for each user account, including which internal systems and apps the person can access.
TechCrunch broke down the records it reviewed by agency:
- about 21,000 at CBP
- about 10,000 at ICE and Homeland Security Investigations
- just under 1,000 at the Cybersecurity and Infrastructure Security Agency (CISA)
- thousands more at DHS headquarters, US Citizenship and Immigration Services and the Federal Protective Service
The hackers say the dataset covers almost a fifth of DHS's workforce (L.A. TACO). They also admit it is incomplete and may contain errors. None of the reporting mentions Social Security numbers, financial data or home addresses.
Why It Matters
The most serious harm here is to people's safety, not to their finances. DHS has worked hard to keep the identities of its enforcement staff hidden. Straight Arrow News notes that agents often mask their faces in public, and DHS has refused to name officers involved in violent incidents. The department says threats against its employees have risen since 2025. This leak links names to roles, phone numbers and facilities. It also names people in undercover and surveillance work, where exposure can end investigations and put officers and their sources in danger.
For defenders, three lessons stand out:
- A staff directory is intelligence. None of the fields would be classified on its own. Combined, with group memberships and reporting lines, they reveal sensitive programs and who runs them. Best called the dataset "extraordinary but deceptive in its simplicity."
- Group names can reveal secrets. Access groups named after wiretap programs or undercover units turn a routine identity-system export into an operational disclosure.
- Detection and disclosure are lagging across government. DMDC went about nine months without spotting its breach. GAO is reportedly preparing to criticise DHS for slow notification on HSIN. And this breach first became public through the attackers, not DHS.
The exposed contact data will also make convincing phishing, phone-based social engineering and harassment against named staff much easier, including the CISA employees.
The Attack Technique
How the attackers got in has not been confirmed. DDoSecrets and the hackers say the data came from DHS's Okta single sign-on system, which employees and contractors use to log in to DHS's central network (TechCrunch, WIRED, L.A. TACO). Okta told WIRED it is "unaware of any breach of its systems" and has "no evidence our data or systems were compromised."
Those two accounts do not necessarily conflict. Okta's statement covers Okta's own platform. It does not rule out someone taking data out of DHS's own Okta account using stolen login details, a hijacked session or an over-permissioned API token. That kind of attack would not require any flaw in Okta. DHS has not said how the data was accessed, and no forensic findings have been published. Any explanation of the method is speculation until DHS or an investigator releases findings.
What Organizations Should Do
- Treat your identity provider directory as sensitive data. Limit who and what can list users, groups and profile fields through admin consoles and APIs. Review API tokens and service accounts that have read access to the whole directory, and remove any that are unused or too broad.
- Alert on bulk directory reads. Watch identity provider system logs for large user or group exports, unusual API paging, and new tokens or admin sessions from unfamiliar networks. One account reading the whole directory should page someone.
- Harden admin access against session theft. Require phishing-resistant MFA (FIDO2 or passkeys) for administrators, bind sessions to devices where possible, keep admin sessions short, and require re-authentication for admin actions.
- Don't put sensitive programs in group names. Use neutral identifiers for access groups tied to surveillance, undercover or investigative work. Keep the mapping to real program names in a separately protected system.
- Plan protective response for exposed staff. If personnel data leaks, warn affected employees about targeted phishing and phone scams, offer number changes and help removing their details from people-search sites, and review physical security at exposed facilities.
- Notify quickly. Report incidents to oversight bodies and affected staff promptly. Learning about a breach from a leak site does more damage than early disclosure.
Sources: Massive Leak Exposes 41,000 Homeland Security Workers—Including Und... | Hacker stole personnel data about thousands of Homeland Security em... | Watchdog to examine summertime hack of DHS information network, oth... | Hackers stole Pentagon personnel records of over 3 million people | Pentagon personnel breach — undetected for months | Leak website releases data on tens of thousands of DHS employees | Shielded by DHS, immigration agents’ identities exposed in massive... | Hackers Expose Personal Information of Over 40,000 DHS Employees ~...