DHS data leak exposes work details of 41,000 Homeland Security employees and contractors, including ICE and CBP staff

A hacker group has leaked a database containing work and contact details for more than 41,000 people who work for the U.S. Department of Homeland Security or its contractors, with most of the records tied to Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE). DHS says it is aware of a “potential breach” and is working to address it.

WIRED first reported the leak on Wednesday, Oct. 28, calling it unprecedented. SecurityWeek followed on Thursday with statements from DHS and from identity company Okta.

What happened

According to WIRED, the transparency nonprofit Distributed Denial of Secrets (DDoSecrets) published the archive on Wednesday under the name “Icepick.” DDoSecrets and researcher maia arson crimew said they obtained the data from a group calling itself the “Department of Peace.” In a note with the files, the hackers wrote: “They have our information, so it’s only fair that we have theirs.”

The hackers and DDoSecrets say the data came from the Okta single sign-on system that DHS employees and contractors use to log in to internal systems. Okta disputes that its systems were compromised. “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised,” an Okta spokesperson told both outlets.

How the data was actually obtained has not been independently established in the reporting so far. WIRED said the records were last updated on Aug. 19, 2026.

What information was exposed

Per WIRED and SecurityWeek, the records include:

• Names, work email addresses and phone numbers (WIRED says some cell phone numbers)
• Job titles, office locations and, in most records, a supervisor
• Lists of which internal systems and applications each account can access

WIRED’s analysis found CBP staff make up more than half of the records. About 10,000 belong to ICE, roughly a third of them in Homeland Security Investigations (HSI), its investigative arm. About 6,200 are tied to U.S. Citizenship and Immigration Services and nearly 1,000 to the Cybersecurity and Infrastructure Security Agency, more than half of those contractors. In all, WIRED estimated the files cover about a seventh of the DHS workforce.

The most sensitive material is not the contact details but the permission-group names, of which WIRED counted more than 55,000. Some appear to reference undercover operations, wiretap and intercept programs, and surveillance and phone-analysis tools. WIRED reported that 39 HSI employees belong to groups whose names include “CUC,” which court filings say stands for “certified undercover operation.”

WhatTrendz is not reproducing any names or personal details from the leaked data.

Why it matters

Security experts quoted in the coverage warned that the access information could be a roadmap for further attacks. “If an attacker knows which employees have access to which systems and applications, they’ve essentially been handed a roadmap for where to go next and who to target to get there,” Gary Barlet, public sector CTO at Illumio, told SecurityWeek.

Alexander Leslie of Recorded Future told WIRED that, “if authentic and current,” the dataset would be “an extraordinarily valuable intelligence resource for those seeking to penetrate DHS,” especially when combined with other compromised data.

The leak also lands in a fierce political fight over identifying immigration officers. WIRED noted that the Trump administration has moved to shield DHS employees’ names and faces, has expanded its definition of “doxing,” and has prosecuted protesters for posting information about individual ICE officers. A FIRE attorney told WIRED that names and basic work details are “information that would be on a business card.” The leakers describe the archive as an accountability tool rather than doxing.

According to SecurityWeek, the incident comes a month after the extortion group ShinyHunters breached FBI systems and three months after the Homeland Security Information Network was hacked.

What DHS says

“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available,” a DHS spokesperson said. The FBI referred WIRED’s questions to DHS, and the Justice Department did not respond, WIRED reported.

FAQ