Hacktivists leak personal data of 41,000+ DHS employees in major security breach

More than 41,000 current and former U.S. Department of Homeland Security (DHS) employees have had their personal details published online by a hacktivist group, in what threat researchers describe as an unusually deep exposure of the agency's workforce and internal systems.

The leaked records include names, job titles, work email addresses, phone numbers, and office locations, according to reporting by TechCrunch and SecurityAffairs. The data covers roughly one-fifth of DHS's 220,000 employees, and includes border and immigration agents, cybersecurity staff, and senior department officials.

More than half of the records — around 21,000 — belong to U.S. Customs and Border Protection (CBP) employees working at airports, seaports, and land border crossings. Another 10,000 belong to Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations unit, while just under 1,000 are linked to the Cybersecurity and Infrastructure Security Agency (CISA). Thousands of additional records cover DHS headquarters and agencies including U.S. Citizenship and Immigration Services and the Federal Protective Service.

The group behind the leak, which calls itself "Department of Peace," claims the data was taken from an Okta single sign-on system that DHS staff use to log into the department's central network. The system also stores IT and login records for each account, revealing which internal apps and tools each person can access. Okta said it has seen no evidence that its own systems were compromised.

The exposed access lists include everyday office software alongside sensitive surveillance tools: Palantir's Falcon investigative platform, the phone and social media analysis tool PenLink, and Mobile Fortify, a facial recognition app used by immigration agents. More than 2,000 Homeland Security Investigations employees appear in PenLink-related groups, and around 4,500 accounts belong to a Headspace user group, according to SecurityAffairs.

WIRED reported that the leak includes staff who work undercover, as well as personnel in sensitive areas such as wiretapping and interception of communications. DDoSecrets said the database identifies officials involved in undercover operations and key DHS personnel overseeing renditions and deportations.

The data was published under the title "Icepick" and is available via torrent or a searchable web interface, making it significantly easier for third parties to query.

DHS confirmed it is aware of a potential breach and is investigating. "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available," a DHS spokesperson told SecurityWeek.

The hacker did not reveal how the agency was breached. A note left with the leaked data, seen by TechCrunch, said that if others have their information, it is only fair to share theirs. The group previously said the leak was a response to the government's actions against ICE.

Journalist maia arson crimew shared the data with DDoSecrets, which co-founder Emma Best said could support journalism, congressional inquiries, legal challenges, and community investigations. "Rather than an indiscriminate directory of every DHS employee, Icepick identifies many of the architects and drivers of DHS policy and operations," Best said, adding that it identifies officials responsible for overseeing covert and undercover operations, the government's hunt for leakers, and key personnel in DHS's rendition and deportation programs.

Ryan Shapiro of Property of the People said the contact details could help researchers submit more targeted Freedom of Information Act requests. TechCrunch verified some records, which suggest the database was copied around mid-August.

One threat intelligence expert told WIRED that, if authentic, the leaked data was "an extraordinarily valuable intelligence resource for those seeking to penetrate DHS," and could help adversaries identify vulnerable personnel or compromise ongoing investigations.

Security researchers warn the exposed contact details could be used in phishing attacks targeting employees, and that exposing phone numbers and office locations could put agents in physical danger. Experts advise anyone whose details were exposed to treat unexpected emails, texts, and phone calls with caution, particularly any communications claiming to come from IT support or requesting login approval.

The incident follows a string of cybersecurity attacks on U.S. government personnel. In September, the ShinyHunters hacking group claimed to have stolen personal details related to nearly every FBI employee, and records of millions of serving and former U.S. military personnel were reportedly stolen from the Pentagon's human resources unit, according to Bitdefender.

This is also the second DHS breach this year. Earlier, the same group claimed to have breached DHS and accessed contracts between the department, ICE, and more than 6,000 firms including L3Harris, Raytheon, Palantir, Microsoft, and Oracle. In that incident, the hackers cited the killings of Alex Pretti and Renée Good by federal agents in Minneapolis as motivation.