Details of more than 41,000 people working for the United States Department of Homeland Security (DHS) have been published online after a hacker stole the records in a previously undisclosed breach earlier this year, according to reporting by TechCrunch and the BBC. The Homeland Security data leak, published on Wednesday, October 28, covers staff across the department’s border, immigration, cybersecurity and headquarters agencies.
The dataset, shared publicly under the name “Icepick”, was put online by a hacker group calling itself the Department of Peace, working with cybersecurity researcher maia arson crimew and the nonprofit collective Distributed Denial of Secrets (DDoSecrets), which now hosts the archive.
FAKTA: What the Homeland Security Data Leak Contains
- Scale: More than 41,000 DHS employees and contractors — roughly one-fifth of the department’s workforce of around 220,000 people.
- Contents: Names, job titles, work email addresses, cell phone numbers and office locations, plus more than 55,000 internal permission groups.
- Breakdown: About 21,000 records relate to Customs and Border Protection (CBP); around 10,000 to Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations unit; and just under 1,000 to the Cybersecurity and Infrastructure Security Agency (CISA).
- Timing: The records appear to have been taken around mid-August 2026, with files last updated on August 19.
- Source of the data: The hacker claims the data came from an Okta single sign-on system used by DHS staff; Okta says it has no evidence its systems were compromised.
- Response: The Department of Homeland Security did not immediately respond to requests for comment.
How the Homeland Security Data Leak Came to Light
TechCrunch, which reviewed the data before publication, reported that the hacker claimed to have obtained the records from the Okta single sign-on system that DHS employees and contractors use to log in to the department’s central network. That system also holds records of which internal tools and applications each user is permitted to access.
Okta said it was aware of the report. “Okta is secure, and we have no evidence our data or systems were compromised,” a spokesperson said. The Department of Homeland Security did not immediately respond to requests for comment from TechCrunch or the BBC.
TechCrunch verified a portion of the data as authentic by matching the names of several known Homeland Security employees against an offline copy of the database. The BBC reported that the leak includes work addresses and phone numbers of DHS staff, including agents working with ICE and Customs and Border Protection, along with descriptions of the work they do.
Surveillance Tools Revealed in the Records
Beyond personal details, the leaked records reveal which internal tools and surveillance technologies DHS employees can access, through membership of internal user groups. Dozens of groups reference PenLink, a web surveillance company whose technology is described as capturing and analysing phone calls, texts, web activity and social media.
One group includes more than 200 CBP users associated with Mobile Fortify, a facial-recognition app used by CBP and ICE agents to identify people and verify immigration status. Other groups reference Palantir’s Falcon platform and tools linked to investigations into hacking groups. Around 4,500 users, including ICE agents and deportation officers, were members of a group for the online therapy provider Headspace, which said it has not provided any services to DHS or ICE since 2023.
A Pattern of Recent Government Breaches
The leak is the latest in a series of breaches affecting US government agencies in recent months, following the theft of thousands of FBI agents’ personnel records and the personal information of millions of serving and former military personnel from the Pentagon’s human resources unit. It is also the second breach involving Homeland Security this year, after the same hacker previously claimed to have taken thousands of contracts between the department and private-sector vendors.
DDoSecrets co-founder Emma Best said the leak was not meant to be a directory of every DHS agent, but aimed to replace “anonymity with accountability”. The hacker left a note with the data reading: “They have our information, so it’s only fair that we have theirs.”
Researchers say the exposed data could support investigations and public-records requests, while security experts warn that a dataset of this kind could also be misused. It remains unclear whether the vulnerability that allowed the breach has been fixed, or whether Homeland Security was aware of the theft before publication.
For more technology and cybersecurity coverage, visit the Technology section on Watan News.
