A data archive containing personal details on tens of thousands of Department of Homeland Security employees and contractors surfaced online this week, exposing names, phone numbers, email addresses and job assignments tied to agents working undercover, in surveillance roles and across DHS's most sensitive units. The leak touches staff at Customs and Border Protection, Immigration and Customs Enforcement, Homeland Security Investigations and the Cybersecurity and Infrastructure Security Agency, among other components.
The archive, dubbed Icepick, was published by the transparency group Distributed Denial of Secrets, which said the data came from an entity calling itself Department of Peace, according to Reuters. Figures on the exact scope vary by outlet: Reuters and Distributed Denial of Secrets describe more than 40,000 affected employees, WIRED puts the figure at more than 41,000, and SAN reports the dataset covers almost 42,000 people, or roughly one-fifth of the agency's workforce.
Reuters reported that it matched personal information about six DHS employees named in the leak against credit bureau records and data from a prior breach at District 4 Labs, and separately called three employees directly to confirm phone numbers and other details found in the archive. One DHS employee told Reuters it was the first they had heard of any breach. DHS did not immediately return Reuters's message seeking comment.
What's Actually in the Files
According to Distributed Denial of Secrets, the records reveal employee names, offices, contact information and assignments, spanning DHS and seven component agencies. WIRED's analysis found CBP staffers account for more than half of the records, with ICE accounting for about 10,000 entries and U.S. Citizenship and Immigration Services for another 6,200. The outlet reported the data was last updated on August 19.
Reuters reported that the leaked data included information drawn from some employees' LinkedIn profiles, along with nonpublic details about internal DHS organization charts and previously undisclosed programs. Per WIRED, the files also contain job titles and email groups pointing to assignments in special operations, surveillance, computer forensics and undercover work — including 39 Homeland Security Investigations employees across more than a dozen field offices belonging to groups whose names include the label “CUC.” A separate review by Unicorn Riot counted more than 20 such CUC groups in the dataset, which it described as ICE workgroups tied to certified undercover operations. WIRED also found roughly 1,000 accounts tied to CISA, more than half of them contractors, and more than 700 accounts tied to a group apparently referencing the messaging app Signal, almost all belonging to CBP personnel.
Disputed Claims Over How the Data Was Obtained
Emma Best, a co-founder of Distributed Denial of Secrets, told Reuters that Department of Peace harvested the data from the Okta single sign-on service used by DHS. Reuters said it could not corroborate that claim, and could not verify the authenticity of the entire data trove. Okta, for its part, told TechCrunch that it has no evidence its data or systems were compromised. TechCrunch reported separately that it verified a portion of the dataset as authentic by checking names of known Homeland Security employees against an offline database copy.
Department of Peace has claimed responsibility before: the group said it hacked DHS and posted documents related to contracts with outside vendors back in March 2026, Reuters reported. In comments to Reuters, the group argued that since DHS employees already have the group's information, it's fair that the group now has theirs, and said it hoped the released data could limit further harm by the agency and support efforts toward that end. Best told Reuters that Maia arson crimew developed a public search tool for the data, which Best said would replace anonymity with accountability.
Part of a Rough Month for Federal Cybersecurity
The DHS leak lands amid a string of breaches at federal agencies. Reuters reported that the ransomware group ShinyHunters claimed in September to have stolen FBI data including sensitive job details and medical information from thousands of bureau employees — a claim Ars Technica also noted, writing that it has been a bad month for federal government cybersecurity. Separately, Reuters reported that the Defense Department was hit with a class action lawsuit in October over a breach exposing data on millions of current and former military personnel. According to Defense One, a Pentagon Defense Manpower Data Center breach potentially exposed information on roughly 3 million people between October 2025 and July 2026, including unencrypted Social Security numbers and, for some individuals, birth dates and military occupational specialties. Defense One noted no public evidence has linked that intrusion to the FBI incident, even though both exposed information that could help attackers target government personnel.
This is not the first time DHS personnel data has surfaced in a leak. A separate cache reported in January tied to roughly 4,500 DHS personnel, including ICE and Border Patrol employees, included names, work email addresses, phone numbers, job titles and resume-style work history, according to Bright Defense. And a March leak reported by TechRepublic reportedly included details on 6,681 organizations that had applied for DHS contracts. Whether the Icepick archive is fully authentic, how it was actually obtained, and what DHS plans to do in response all remain open questions the agency has not yet addressed.
