A DHS data breach has exposed the personal details of more than 40,000 Department of Homeland Security employees, including ICE and Border Patrol agents, in one of the largest leaks of federal personnel information ever made public. The dataset, published online on Wednesday, October 28, 2026, under the name Icepick, lays bare names, phone numbers, email addresses, job titles and office assignments across the department — including staff assigned to undercover work, surveillance and special operations.

The Department of Homeland Security said it was aware of a potential breach and was working to address it swiftly, but it has not confirmed the full scale of the leak or said whether any employees have been harmed. For a workforce of a little more than 220,000 people, the exposure of roughly a fifth of its staff — days before the November 3 midterm elections — raises urgent questions about how the data was taken, who now holds it, and what happens to the agents whose identities were meant to stay hidden.

Key Points

• A DHS data breach published October 28, 2026, as the Icepick dataset exposed records for more than 40,000 department employees and contractors.
• About 21,000 records relate to Customs and Border Protection staff and about 10,000 to Immigration and Customs Enforcement, including Homeland Security Investigations.
• The leaked material includes names, phone numbers, email addresses, job titles, office locations and internal access groups, including undercover and surveillance roles.
• The group calling itself the Department of Peace says it harvested the data from DHS's Okta single sign-on system; Okta says it has no evidence its systems were compromised.
• DHS says it is aware of a potential breach and is working to ensure staff are properly protected, while Reuters independently matched several leaked records to real employees.

What Happened

On Wednesday, October 28, the transparency nonprofit Distributed Denial of Secrets (DDoSecrets) published the Icepick dataset, which it said draws on information obtained by an entity calling itself the Department of Peace. The group, in a note attached to the files, wrote: "They have our information, so it's only fair that we have theirs." It added that it hoped the data "can be used to limit further harm by the DHS and supports all efforts in that direction."

The records span seven DHS component agencies, according to early reporting on the leak: Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), U.S. Citizenship and Immigration Services (USCIS), the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Protective Service, Homeland Security Investigations and the Federal Law Enforcement Training Center. More than 21,000 records identify CBP employees, and another 10,000 relate to ICE and its Homeland Security Investigations unit. Around 6,200 records are linked to USCIS and just under 1,000 to CISA, with the remainder spread across the other components.

What makes the leak unusually sensitive is not just the headcount but the detail. Alongside names, phone numbers and email addresses, the dataset contains job titles and email groups that reveal which agents were assigned to special operations, surveillance jobs, computer forensics and undercover work. In several cases, reporting found, the data went beyond what is publicly visible on professional profiles such as LinkedIn, revealing nonpublic details about internal organisation charts and previously undisclosed programmes or operations.

A searchable online database for the material was built by the hacktivist known as "maia arson crimew" together with U.S.-based journalist Ryan Ottignon, with crimew doing the technical work, Ottignon told NPR. DDoSecrets co-founder Emma Best said the tool would "replace anonymity with accountability" and empower journalists, guide public records requests and boost congressional oversight. Best called the leak "extraordinary but deceptive in its simplicity," because it makes explicit connections between "officials responsible for overseeing covert and undercover operations … along with key personnel in DHS's ever-escalating rendition and deportation programs."

Background and Context

The Department of Homeland Security is the federal government's third-largest department, with a workforce of a little more than 220,000 people, according to staffing data cited in the reporting. The Icepick records therefore cover roughly a fifth of the department — about 15 to 20 percent depending on the count used, with early accounts putting the total at approximately 40,000 and later counts exceeding 41,000. The exact figure has not been settled, and DHS has not published its own count.

The Department of Peace is not new to DHS. In March 2026, the same group claimed responsibility for hacking the department and posting documents related to contracts with outside vendors. This time, according to DDoSecrets, the group harvested the personnel data from the Okta single sign-on service used by DHS. One early account said the most recent dataset update was August 19, 2026, suggesting prolonged access — a claim Reuters said it could not immediately corroborate. Okta, in response to a Reuters query, said: "Okta is secure, and we have no evidence our data or systems were compromised." That leaves the precise intrusion route unresolved: a compromised single sign-on system, a stolen credential, or another entry point could each explain how so many records were gathered.

Icepick is the third major government data leak to make headlines in the past month. In September, the hacking group ShinyHunters claimed the theft of a large trove of data from the Federal Bureau of Investigation, including sensitive job details and medical information from thousands of bureau employees. Last week, the Defense Department was hit with a class action lawsuit following a breach that exposed data on millions of current and former military personnel. Security researchers have warned that staff contact data is prized by attackers because it makes phishing messages far more convincing — a risk U.S. agencies have already flagged ahead of the midterm elections.

The timing sharpens the political edge. ICE officers, many of whom wear masks and plain clothes during enforcement operations in American cities, have become a flashpoint in the election campaign, with the administration's deportation drive a central issue in the final days before November 3. The Department of Peace framed the leak in exactly those terms. In an online statement, a spokesperson said: "On July 17th, Markwayne Mullin said he was 'turning up the heat.' This is what happens to ICE when you do that." Mullin is the Secretary of Homeland Security. Ottignon, rejecting suggestions that the project amounts to doxing government employees, told NPR: "We are in a situation in which a group of public officials go around into cities and states and all around the country, and they seek to hide who they are. Very frequently using masks, wearing plain clothes. And they do universally unspeakable things to these communities. We need oversight for useful government, if it exists at all. So this is just one step in that oversight process."

DHS Data Breach: What Was Exposed and What It Means

The practical risks fall into three buckets. First, personal safety: agents whose names, phone numbers and field-office assignments are now searchable could face harassment or threats, particularly officers working undercover or on sensitive investigations. Second, operational security: the access-group information maps internal structures, showing who works on surveillance, human intelligence, computer forensics and special operations, and where they sit in the organisation. Third, follow-on attacks: names, titles, work emails and phone numbers are the raw material for impersonation and phishing, which can open the door to deeper intrusions if a single employee clicks the wrong link.

Reuters, which could not immediately verify the authenticity of the entire trove, was able to match personal information about six DHS employees named in the leak to credit bureau records and breach data held by the dark-web intelligence platform District 4 Labs. In other cases, reporters called three DHS employees directly and confirmed their phone numbers and other details. One said it was the first they had heard of a breach. That independent matching is why news organisations are treating the dataset as substantially genuine, even though its full contents remain unverified.

For the public, the leak cuts both ways, and both arguments are already being made loudly. Transparency advocates say email addresses and phone numbers are indispensable tools for freedom-of-information researchers, often making the difference between a vague records request that gets stonewalled and one that produces results. Ryan Shapiro, executive director of the nonprofit Property of the People, said in reporting on the leak: "Given the Trump administration's contempt for even basic transparency, the need for such tools is urgent." Best said the dataset will be a "catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests." Critics, including many current and former officials, argue that publishing the identities of undercover and frontline officers endangers people who did not choose public exposure and could compromise live investigations, regardless of one's view of the department's policies.

Reactions and Quotes

The Department of Homeland Security's public response so far has been brief. In a statement, the department said it was "aware of a potential breach and is actively working to address the situation swiftly and effectively." It added that it is taking necessary steps to "ensure all are properly protected." The department did not immediately return a message seeking comment when Reuters first reported the leak, and it has not said whether it has notified affected employees, reset credentials, or identified how the data left its systems.

Okta pushed back on the claimed route into the data. "Okta is secure, and we have no evidence our data or systems were compromised," the company told Reuters. That denial does not settle the question — a single sign-on system can be abused through stolen credentials without the vendor itself being breached — but it does mean the Department of Peace's account of how the data was harvested remains uncorroborated.

On the transparency side, Emma Best of DDoSecrets said the search tool built for the data would "replace anonymity with accountability." Ottignon went further, framing the leak as oversight of masked enforcement: "We need oversight for useful government, if it exists at all. So this is just one step in that oversight process." The Department of Peace itself was blunter still: "They have our information, so it's only fair that we have theirs."

So far, no major lawmaker has publicly announced an investigation specifically into the Icepick leak, but the dataset's stated purpose — fuelling congressional inquiries and public-records requests — all but guarantees questions in Washington in the coming days, especially as the leak lands five days before voters choose the next Congress.

Why It Matters

This breach matters because it strikes at the bargain that undercover and enforcement work depends on: that an agent's identity stays separate from their operations. Once a searchable database links a name to a surveillance unit, a special-operations assignment or a field office, that separation is gone for good — the data cannot be unpublished. Even if DHS hardens its systems tomorrow, the Icepick files will circulate indefinitely.

It matters, too, because of the pattern. Three major government personnel leaks in a single month — the FBI in September, the Pentagon's military personnel data last week, and now DHS — point to a systemic problem rather than a single lapse. Federal agencies hold the country's most sensitive personnel files, and attackers, whether criminal gangs or politically motivated hacktivists, have repeatedly shown they can get at them. Each leak also teaches the next attacker what works.

Finally, it matters politically because it arrives at the worst possible moment for a department already at the centre of the election. Supporters of the leak will present it as accountability for masked enforcement operations; opponents will present it as an attack on law enforcement itself. Either way, the debate will now play out with 40,000 names attached to it — and with the midterm vote just days away, that debate is unlikely to wait for a formal investigation to conclude.

What Happens Next

The immediate questions are for DHS itself: confirm the scope, notify affected staff, force password and credential resets, and explain how the data was obtained. If the Okta route is confirmed, expect a wider review of single sign-on access across the department; if it was a credential theft, expect questions about multi-factor authentication and monitoring. Either way, employees who learn their details were exposed will want to know what protection — credit monitoring, phone-number changes, or reassignment for undercover staff — the department will offer.

Watch also for congressional reaction. The leak was explicitly designed to feed oversight, and members of both parties have previously demanded briefings after federal breaches. A classified briefing for the House and Senate homeland security committees is a likely next step, as are public letters demanding a timeline of when DHS first learned of the intrusion. Law enforcement agencies may also open a criminal investigation into the Department of Peace, though hacktivist groups behind past leaks have proved difficult to identify and prosecute.

Longer term, the Icepick dataset is likely to surface in reporting, lawsuits and public-records requests for months. Journalists can now name the officials behind programmes that were previously anonymous; lawyers can target requests with precision; and advocacy groups can map the department's internal structure in ways that were impossible before. Whether that produces accountability, harm, or both is the argument the country will now have — with the data already out of the bottle.

Frequently Asked Questions

What is the DHS data breach?

It is the publication, on October 28, 2026, of a dataset called Icepick containing personal and work details for more than 40,000 Department of Homeland Security employees and contractors, obtained by a group calling itself the Department of Peace and published by the nonprofit Distributed Denial of Secrets.

Which agencies were affected?

Records span seven DHS components, including Customs and Border Protection (about 21,000 records), Immigration and Customs Enforcement and Homeland Security Investigations (about 10,000), U.S. Citizenship and Immigration Services (about 6,200) and the Cybersecurity and Infrastructure Security Agency (just under 1,000), plus the Federal Protective Service and the Federal Law Enforcement Training Center.

What information was exposed?

Names, phone numbers, email addresses, job titles, office locations and internal access-group information, including assignments to special operations, surveillance, computer forensics and undercover work. The dataset does not appear to include Social Security numbers or medical information, unlike the earlier FBI and Pentagon leaks.

Has DHS confirmed the breach?

DHS said it was "aware of a potential breach and is actively working to address the situation swiftly and effectively" and is taking steps to "ensure all are properly protected." It has not confirmed the full scale or explained how the data was taken. Okta, whose sign-on service the hackers say they exploited, says it has no evidence its systems were compromised.

Is the leaked data real?

Its full contents have not been independently verified, but Reuters matched personal information for six employees in the leak to credit bureau and dark-web records and confirmed phone numbers for three employees by calling them directly, which strongly suggests the dataset is substantially genuine.

Related coverage: Brooklyn Bridge anti-ICE protest: 13 arrested as activists block traffic, ICE surge in Detroit: activists report stops near schools and voting site, and Wisconsin governor poll: Crowley leads Tiffany 51-44 in final Marquette survey.

Sources: Reuters, October 28, 2026; NPR via WCMU, October 28, 2026; Bloomberg Government, October 29, 2026; Gadgets Now / Times of India, October 29, 2026; iTech Post, October 29, 2026.