A major DHS data breach has exposed the personal details, internal assignments and surveillance tools of more than 41,000 Department of Homeland Security employees and contractors. The records, compiled into a searchable public database named Icepick on Wednesday, lay bare sensitive organisational charts across immigration enforcement and border patrol divisions.
Key points
- A dataset containing over 41,000 personnel files from the Department of Homeland Security was published online by transparency collective Distributed Denial of Secrets.
- The leak compromises details from more than 21,000 Customs and Border Protection staff and nearly 6,600 Immigration and Customs Enforcement personnel.
- Records disclose internal operations, undercover programmes, and operational ties to commercial surveillance suppliers including Palantir, Cellebrite and PenLink.
- Hacktivists claimed to have harvested the profiles through identity platform Okta, though Okta stated it has found no evidence of an intrusion on its systems.
What the leaked records contain
The disclosure covers an array of operational and personnel records from across the Department of Homeland Security. Alongside names, work email addresses, office locations and phone numbers, the database includes internal job descriptions, staff email groups and organisational hierarchies. These records expose how individual agents are positioned within the agency and link specific officials to covert and undercover operations.
Customs and Border Protection accounts for the largest share of the leaked files, with more than 21,000 staff members listed. A further 6,600 records belong to personnel at Immigration and Customs Enforcement. The database also indexes staff from Homeland Security Investigations, the Federal Protective Service, US Citizenship and Immigration Services, and the Cybersecurity and Infrastructure Security Agency, the federal body responsible for defending American networks from digital attacks.
Beyond staff directories, the dataset exposes dozens of internal operation titles that were previously confidential. It identifies lead investigators on specific cases, details teams tasked with hunting government leakers, and reveals personnel linked to the review of the 2020 BlueLeaks police data release. In several instances, reporters matched listed phone numbers and details directly to agency staff, while other files mapped to open-source career profiles on networks such as LinkedIn.
Surveillance software and private vendors
The leak provides rare visibility into the commercial software stacks used by immigration investigators and federal border agents. The records connect specific task forces and field teams to commercial intelligence tools, documenting where federal officers run forensic extracts, telephone record analyses and automated facial comparisons.
Among the platforms named in the files are forensic tools supplied by Israeli digital intelligence company Cellebrite, as well as data integration software from Palantir Technologies. The records also reference PenLink, a surveillance software suite used by law enforcement agencies to collect and evaluate communication metadata, internet traffic and location histories. In addition, files list assignments involving Mobile Fortify, a mobile application that gives field agents handheld facial recognition capabilities.
Civil liberties researchers have long questioned the breadth of private contractor surveillance deployed by immigration officials. By connecting software licences directly to named staff, operational units and specialised squads, the leak maps how digital surveillance contracts translate into day-to-day federal enforcement on the ground.
How the breach occurred
Responsibility for the data extraction was claimed by an entity calling itself the Department of Peace. The files were transferred to cybersecurity researcher maia arson crimew, who developed a search system to query the records, and were subsequently published by Distributed Denial of Secrets, a non-profit archival group specialising in leaked public-interest datasets.
The Department of Peace stated that it extracted the employee directory through Okta, the cloud-based identity and access management service that DHS uses to manage staff logins. Single sign-on tools such as Okta serve as a centralised gatekeeper, allowing workers to access multiple enterprise tools and internal databases through a unified set of credentials. When an administrative portal or single sign-on system is misconfigured or hijacked, it can allow unauthorised users to scrape vast corporate directories.
Okta contested the claim that its core infrastructure was breached. In a statement addressing the incident, a spokesperson said the company was aware of the allegations but maintained that its systems remained secure, stating that it had found no evidence of a compromise within its network. Security specialists noted that attackers can compromise identity platforms using stolen client credentials, session tokens or misconfigured permissions, without exploiting any flaw in the vendor software itself.
A spokesperson for the Department of Homeland Security said the department was aware of a potential breach and was working to address the matter swiftly. The spokesperson added that the department takes all security threats against its officers and employees seriously and will update the public as more information becomes available.
A pattern of intrusions across federal agencies
The publication of the Icepick database marks the third major computer security incident to target United States federal institutions within recent weeks. Federal networks have faced an aggressive sequence of intrusions aimed at uncovering sensitive personnel directories.
In September, the criminal extortion group ShinyHunters claimed responsibility for stealing an extensive cache of records from the Federal Bureau of Investigation, which included job details and medical records of thousands of bureau agents. Days later, the Federal Election Commission took its public campaign donation portals offline following a suspected cyber-attack. The Department of Defense has also faced legal challenges after a separate data exposure revealed records on millions of active and former service members.
This incident differs from criminal ransomware operations because the actors sought no financial ransom. Emma Best, a co-founder of Distributed Denial of Secrets, said the group published the material to replace administrative anonymity with public accountability, arguing that the database will assist journalists and congressional oversight committees in scrutinising the department.
Operational scrutiny and digital blowback
The data leak lands amid mounting public debate over the tactics and identification of immigration officers. Federal agents have routinely carried out street-level arrests while wearing civilian clothing, sunglasses and face coverings, obscuring their identities from the public. While federal rules instruct personnel to disclose their agency affiliation, law enforcement officers often decline to display identification during raids.
Members of Congress have publicly demanded that Homeland Security leaders enforce policies requiring personnel to identify themselves when making arrests. Discontent has intensified as federal deportations surpassed nearly 1 million deportations under accelerated executive orders, with enforcement operations drawing intense community opposition following several fatal enforcement shootings during the past year.
Homeland Security Secretary Markwayne Mullin, who assumed leadership of the department in March, pledged during the summer to accelerate enforcement activity across border and interior regions. The Department of Peace specifically cited those public comments when publishing the stolen records, framing the digital breach as direct retaliation against the department’s enforcement directives.
Federal cybersecurity teams and intelligence agencies are now reviewing the Icepick archive to gauge physical and digital risks to the named personnel, as congressional committees prepare formal inquiries into how the agency’s primary personnel directories were extracted.
