A leak site has published work contact details and job assignments for more than 41,000 employees and contractors of the United States Department of Homeland Security (DHS), in one of the largest exposures of federal personnel information in recent years.
The database, called “Icepick”, was published on Wednesday, October 28, by the transparency nonprofit Distributed Denial of Secrets (DDoSecrets). The group said it received the material from a hacktivist group calling itself the Department of Peace, working with researcher and hacker maia arson crimew.
According to reporting on the release, the records include names, work email addresses, phone numbers, office locations, job titles and internal group memberships. They cover staff at Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), Homeland Security Investigations, US Citizenship and Immigration Services, the Cybersecurity and Infrastructure Security Agency (CISA) and other DHS components. More than 21,000 of the records relate to CBP staff, the largest single share.
The job titles and group memberships are a central part of the story. Reporting on the data says they identify people assigned to special operations, surveillance, computer forensics and undercover work, and show which internal groups have access to tools including the Mobile Fortify facial-recognition app and PenLink, a system for collecting and analysing phone and online data. Technology from Palantir and Cellebrite is also named in the reporting.
What is confirmed, and what is not
Several outlets independently checked parts of the data before publication. Nextgov/FCW said it corroborated portions of the data, including one official’s work phone number its reporter had independently obtained before the leak, and found LinkedIn profiles matching job titles in the records. Reuters separately reported matching six records and directly confirming details with three employees, according to a summary of its reporting.
No outlet has reported that passwords or Social Security numbers were included, and the full archive has not been independently validated row by row. The records were reportedly last updated on August 19, 2026, meaning some entries may describe people who have since changed roles or left the department; Nextgov noted it identified former CISA employees among the names.
How the data was obtained remains a claim, not an established finding. DDoSecrets said the material came from DHS’s Okta identity system. Okta said it had no evidence its data or systems were compromised. The entry point has not been confirmed by DHS, a court filing or a technical disclosure.
DHS response
DHS said in a statement that it was “aware of a potential breach and is actively working to address the situation swiftly and effectively”, and that it was working to ensure its employees were properly protected and would update the public when more information was available.
DDoSecrets co-founder Emma Best said the aim of the release was to replace “anonymity with accountability”, arguing the data shows who does what work across DHS agencies, including ICE, at a time when the department’s immigration enforcement has drawn intense public scrutiny.
Why it matters
The leak exposes the workforce behind the Trump administration’s expanded immigration enforcement, including officers involved in arrests, deportations and surveillance work. Security researchers quoted in coverage warned that combining names, job titles, work phone numbers and assignments creates ready-made profiles for impersonation, phishing or physical targeting of staff, including those in sensitive roles.
It is also the third major government data disclosure to make headlines in the past month. In September, the hacking group ShinyHunters claimed the theft of FBI employee data, and in October the Defense Department faced a class-action lawsuit after a breach exposed data on millions of current and former military personnel.
What happens next
DHS has not said how many current employees are affected, whether it has notified them, or what protective measures it is taking beyond its initial statement. Any confirmation of the source of the data, or of disciplinary or criminal action, would be a significant further development, as would evidence about whether the published records are current.
Frequently asked questions
What is the ‘Icepick’ leak?
A database published by DDoSecrets on October 28, 2026, containing reported work contact details and job assignments for more than 41,000 DHS employees and contractors.
Were passwords or Social Security numbers leaked?
No outlet reporting on the release has said either was included. The reported fields are names, job titles, work emails, phone numbers, office locations and internal group memberships.
Has DHS confirmed a breach?
DHS has said only that it is aware of a potential breach and is working to address it. It has not confirmed how the data was obtained.
Where did the data reportedly come from?
DDoSecrets attributes it to a hacktivist group calling itself the Department of Peace, via DHS’s Okta identity system. Okta says it has no evidence its systems were compromised, so that route remains unconfirmed.
Sources
- Nextgov/FCW: https://www.nextgov.com/cybersecurity/2026/10/dhs-personnel-leak-exposes-contact-details-and-sensitive-job-information/416901/
- The Jerusalem Post (Reuters): https://www.jpost.com/international/article-913173
- The Straits Times: https://www.straitstimes.com/world/united-states/leak-website-releases-data-on-tens-of-thousands-of-us-govt-employees
- MyJoyOnline: https://www.myjoyonline.com/details-of-thousands-of-us-immigration-agents-leaked-in-major-hack/
