Hackers Leak Data of 41,000+ DHS Employees, Including ICE and Border Agents

Personal data belonging to more than 41,000 U.S. Department of Homeland Security (DHS) employees has been published online, exposing names, job titles, work email addresses, phone numbers, and office locations of border agents, immigration officers, and cybersecurity staff.

The leak, posted under the title "Icepick," was claimed by a hacktivist group calling itself "Department of Peace." The group said it stole the data from an Okta single sign-on system that DHS staff use to log into the department's central network. Okta said it has seen no evidence that its own systems were compromised.

More than half of the leaked records — around 21,000 — belong to U.S. Customs and Border Protection (CBP) employees, typically stationed at airports, seaports, and land border crossings. Another 10,000 records relate to Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations unit, while just under 1,000 are linked to the Cybersecurity and Infrastructure Security Agency (CISA). Thousands of additional records belong to DHS headquarters and agencies including U.S. Citizenship and Immigration Services and the Federal Protective Service, according to reporting by TechCrunch and SecurityAffairs.

The leak covers roughly one-fifth of DHS's 220,000 employees. TechCrunch verified some records, which suggest the database was copied around mid-August.

Sensitive roles exposed

The leaked database identifies officials involved in undercover operations and key DHS personnel overseeing renditions and deportations, according to DDoSecrets, the transparency collective that received the data from journalist maia arson crimew.

"Rather than an indiscriminate directory of every DHS employee, Icepick identifies many of the architects and drivers of DHS policy and operations," said Emma Best, journalist and DDoSecrets co-founder. "The leak is extraordinary but deceptive in its simplicity as it identifies the officials responsible for overseeing covert and undercover operations, the government's hunt for leakers and the failed BlueLeaks investigation — along with key personnel in DHS's ever-escalating rendition and deportation programs."

WIRED reported the leak includes staff who work undercover, as well as those engaged in wiretapping and interception of communications.

The data also reveals which tools and services each individual can access. Alongside everyday office software like Microsoft 365, the records show access to Palantir's Falcon investigative platform, the phone and social media analysis tool PenLink, and Mobile Fortify, a facial recognition app used by immigration agents. Around 4,500 accounts belong to a Headspace user group, while more than 2,000 Homeland Security Investigations employees appear in PenLink-related groups.

Threat assessment

One threat intelligence expert told WIRED that, if authentic, the leaked data was "an extraordinarily valuable intelligence resource for those seeking to penetrate DHS," and could help adversaries identify vulnerable personnel or compromise ongoing investigations.

The exposed contact details could be used in phishing attacks targeting employees, or could potentially put agents in physical danger, according to the same reporting.

DHS confirmed it is aware of a potential breach and is investigating. "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available," a DHS spokesperson told SecurityWeek.

The hacker left a note with the leaked data, seen by TechCrunch, saying that if others have their information, it is only fair to share theirs. Explaining the justification for the breach, "Department of Peace" wrote: "They have our information, so it's only fair that we have theirs."

Broader pattern

The incident is the second DHS breach this year claimed by the same group. Earlier, the hacktivists said they had accessed contracts between DHS, ICE, and more than 6,000 firms including L3Harris, Raytheon, Palantir, Microsoft, and Oracle.

The breach follows a string of cybersecurity incidents affecting U.S. government personnel. In September, the ShinyHunters hacking group claimed to have stolen personal details related to nearly every FBI employee, and records of millions of serving and former U.S. military personnel were reportedly stolen from the Pentagon's human resources unit.

The leaked data can be downloaded via torrent or accessed through a web interface, making it easier for third parties to search. Researchers said the contact details could help journalists file targeted Freedom of Information Act requests, but exposing employees' phone numbers and office locations also creates security and privacy risks.