Massive DHS data leak exposes over 41,000 workers and agents

An unprecedented data leak from the Department of Homeland Security (DHS) has exposed details of more than 41,000 employees and contractors. The leaked records include email addresses, phone numbers, office addresses, and sensitive references to internal systems, undercover operations, and surveillance programs.

• The records cover DHS and seven component agencies, including ICE and CBP, with data last updated on August 19, 2026.
• Transparency nonprofit DDoSecrets published the archive under the name "Icepick," reportedly sourced from a group called Department of Peace.
• Okta stated it is unaware of any system breaches, while DHS announced it is actively addressing the situation.
• The leak reveals organizational structures, undercover operational groups, AI tool usage, and encrypted communications among personnel.

The files span DHS and seven constituent agencies, including Immigration and Customs Enforcement (ICE) and US Customs and Border Protection (CBP). Distributed Denial of Secrets (DDoSecrets) and cybersecurity researcher maia arson crimew previewed the data for WIRED, obtaining the archive from a hacker collective calling itself the Department of Peace, which claimed the data originated from DHS's Okta login system.

According to a WIRED analysis, CBP staffers account for more than half of the records, while ICE accounts for roughly 10,000. Other records belong to US Citizenship and Immigration Services and the Cybersecurity and Infrastructure Security Agency (CISA). In total, the archive covers about a seventh of the entire DHS workforce, mapping out the agency from leadership down to field agents and contractors.

The leaked permission groups reveal references to certified undercover operations, wiretap programs, and advanced surveillance tools such as Palantir’s Falcon platform, PenLink, and the Mobile Fortify facial recognition app. Additionally, the data lists accounts with access to AI tools like ChatGPT, Gemini, Copilot, and Grok, as well as over 700 accounts associated with the Signal encrypted messaging app.

National security experts warn that if authentic, this dataset represents a high-value intelligence asset. Adversaries could potentially leverage the information to identify vulnerable personnel, execute sophisticated impersonation attempts, or compromise ongoing federal investigations.