The DHS Icepick leak has exposed details of more than 41,000 Department of Homeland Security employees and contractors, in one of the largest disclosures of a federal workforce ever published online. The archive, released on Wednesday, October 28, 2026, by the transparency nonprofit Distributed Denial of Secrets (DDoSecrets), covers DHS itself and seven component agencies and includes work contact details, job titles, supervisors and more than 55,000 internal permission groups that map how the department is organised and how it operates.
For a department that has spent much of the second Trump administration trying to keep its officers' names and faces out of public view, the scale of the disclosure is striking. The records were last updated on August 19, 2026, according to WIRED's analysis, and they cover about a seventh of the DHS workforce. They do not, on the reporting so far, include home addresses. But they do reveal reporting lines, access to surveillance and undercover programmes, and the tools immigration officers use day to day — information that security experts say could be valuable to anyone trying to impersonate staff, probe the department's systems or compromise investigations.
DDoSecrets published the archive, which it calls “Icepick,” on Wednesday. The group said it obtained the data from a hacktivist group calling itself the Department of Peace, working with cybersecurity researcher and journalist maia arson crimew, who built a searchable website for the records. In a note with the files, the group wrote: “They have our information, so it's only fair that we have theirs.”
WIRED and TechCrunch previewed the data before publication. Reuters separately reported that the leak website had released data on tens of thousands of DHS employees, including details about officials working in sensitive fields such as surveillance and human intelligence, and that DHS did not immediately return a message seeking comment.
The records span DHS headquarters and agencies including Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), US Citizenship and Immigration Services (USCIS) and the Cybersecurity and Infrastructure Security Agency (CISA). WIRED's breakdown puts CBP at more than half the files — roughly 21,000 records — followed by about 10,000 from ICE, about 6,200 from USCIS and nearly 1,000 tied to CISA, more than half of them contractors. Roughly a third of the ICE records sit in Homeland Security Investigations (HSI), ICE's investigative wing.
The archive also includes roughly 4,400 “associates,” ranging from IT developers and data scientists to nurses and detention officers, of whom 145 are named as a “contractor” or “high risk contractor.” More than 300 records reference senior headquarters titles, from the secretary down through deputy undersecretaries, assistant secretaries and chiefs of staff. Most records also name a supervisor, which means the dataset can be used to reconstruct reporting relationships across the department.
The leak did not arrive in isolation. Reuters described it as the third major government data leak to make headlines in the past month. In September, the hacking group ShinyHunters claimed to have stolen a massive trove of data from the Federal Bureau of Investigation, including sensitive job details and medical information from thousands of bureau employees. Last week, the Defense Department was hit with a class-action lawsuit following a breach that exposed data on millions of current and former military personnel.
Within DHS, the disclosure lands in a heated argument about anonymity and accountability. Since the start of the second Trump administration, DHS and the federal government have moved to hide employees' names and faces, and the agency has expanded its definition of “doxing” — a term that usually means publishing someone's home address and other personal details for malicious purposes — to include publishing basic facts about public employees, such as their names and titles.
The administration has also prosecuted protesters for posting information about individual ICE officers and warned others against doing so. In June, 15 Minnesota residents were charged under laws related to stalking and threats of violence, which prosecutors linked to their participation in ICE-opposition activities. More than 100 HSI agents, including undercover operatives, took part in an operation that included widespread surveillance and infiltration of group chats, according to WIRED's earlier reporting.
The creators of Icepick reject the doxing label. DDoSecrets co-founder Emma Best said the search tool would “replace anonymity with accountability” and empower journalists, guide public records requests and boost congressional oversight. Crimew told WIRED: “The DHS especially as an agency completely lacks accountability, despite many parts of it being incredibly unpopular.” She added that some staff members' LinkedIn profiles simply say “stuff at US Government.”
The most sensitive part of the DHS Icepick leak may not be the names at all, but the permission groups. Like most large organisations, DHS uses permission groups to control who can access internal systems, and nearly everyone named in the leak has access to at least some of them. In total there are more than 55,000 groups, and their names read like an organisational chart of the department's most sensitive work.
At HSI, 39 employees across more than a dozen field offices belong to groups whose names include “CUC,” which government court filings say stands for “certified undercover operation.” Another group, apparently based in HSI's St. Paul, Minnesota area of operations, references “Keyhole,” which federal court filings describe as a certified undercover operation that recently funded HSI's undercover surveillance of Minneapolis protest groups earlier this year. Other groups reference a “Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program” for wiretaps and an “Illicit Sensor Intercept Program (ISIP).”
The group names also point to the tools themselves. They include Palantir's Falcon investigative platform and PenLink, which analyses phone records and social media. More than 700 accounts are associated with a group apparently referencing Signal, the encrypted messaging app, nearly all belonging to CBP personnel. More than 200 CBP accounts belong to a group referencing Mobile Fortify, a face-recognition app immigration agents use to identify people, including field supervisors, special response team operators and tactical and intelligence agents; about half are in Texas, California and Arizona.
Other groups reference artificial-intelligence tools, including OpenAI's ChatGPT, Google's Gemini and Microsoft's Copilot. One group called “Grok.com” includes eight DHS technology officials, including the department's former chief information officer and chief data officer. Two groups, named “Executive Leadership” and “AI Access,” appear to list the same 13 people given exceptions to DHS's web filter, including former DHS head Kristi Noem and senior advisers.
The records also show the department's recent growth. Roughly 1,300 ICE enforcement accounts have been created since July 4, 2025, when President Donald Trump signed the One Big Beautiful Bill Act, which funded the hiring of 10,000 new ICE Enforcement and Removal officers by the end of 2025. Dozens of accounts carry job titles such as “Designated Immigration Officer” and “287(g) Officer,” marking local law enforcement personnel authorised to carry out some immigration enforcement duties, many listing county sheriff's offices and jails as their workplaces.
Okta pushed back firmly on the claim that its systems were breached. An Okta spokesperson told WIRED: “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised.” DDoSecrets, by contrast, said in its press release that the data came from DHS's Okta login system, and the Department of Peace said it accessed DHS agent profiles through the single sign-on service.
Security experts warned that the risk goes beyond embarrassment. Alexander Leslie, a national security expert at the threat-intelligence company Recorded Future, told WIRED: “If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS.” He added: “This dataset becomes way more valuable when correlated with previously compromised information, commercial data, and other intelligence collections. An adversary could spend months exploiting these relationships to identify vulnerable personnel, develop convincing impersonation attempts, or compromise ongoing investigations.”
Civil-liberties lawyers drew a sharp line between the work details in the archive and genuinely private information. Adam Steinbaugh, a senior attorney at the nonprofit FIRE, said of the names and basic work details: “This is information that would be on a business card. That's not something the government can criminalize.” He was referring to the administration's expansive view of 18 USC 119, a law that prohibits sharing “restricted personal information” about federal officers or their families with the intent to threaten them.
TechCrunch's reporting added a note of caution that applies to the whole archive: it matched the names of several known DHS employees against an offline copy of the database, which is partial verification, not proof that every row is current or accurate. Reuters likewise reported matching six records and directly confirming details with three employees, according to a summary of the verification work. The records themselves were last updated on August 19, so some staff may since have left, changed roles or joined.
The DHS Icepick leak matters for three reasons. First, it reverses the department's own secrecy strategy. An agency that has argued that even names and titles of its officers should be treated as sensitive has now had the working map of its workforce published in searchable form. That will fuel the legal and political fight over what counts as doxing, what counts as public information about public employees, and whether the government can punish people for republishing it.
Second, it exposes operational detail that is harder to undo than a list of names. Undercover operation codenames, wiretap programme labels, surveillance-tool access and reporting lines cannot be “unpublished” once they are circulating. Even if some records are two months old, adversaries, journalists and oversight bodies can now cross-reference them with court filings, earlier leaks and commercial data to build a far more complete picture of how DHS surveillance and enforcement actually work.
Third, it raises a straightforward security question that DHS has not yet answered publicly: how was a directory this large taken from a single sign-on system, and what has changed since? Until DHS confirms the source, the scope and the remediation, every other federal agency that uses similar identity systems will be asked the same question. The silence so far — DHS and the Justice Department did not respond to WIRED, and the FBI referred WIRED's inquiry to DHS — leaves that question open at the worst possible moment, days before the November 3 midterm elections, when immigration enforcement is already one of the central campaign issues.
Expect three tracks in the coming days. DHS will face pressure to confirm whether the data came from its Okta deployment, whether any systems have been locked down or credentials reset, and whether undercover personnel or operations named in the permission groups are at risk. Congress, which has oversight of DHS, is likely to seek a briefing, and the department's inspector general may be asked to review how identity and access data were protected.
Okta will also be under scrutiny. Its statement — no evidence of a compromise of its own systems — does not rule out misuse of a customer deployment, stolen credentials or another route into DHS's directory, and the company may be pressed to explain the distinction in more detail.
Finally, the legal fight over publication is likely to intensify. The administration has already used threats and prosecutions to deter posting information about ICE officers. DDoSecrets and its supporters argue the archive is an accountability tool, not a doxing dump. How courts and prosecutors treat that distinction, and whether DHS tries to have the searchable database taken down, will shape what the public can learn about the department long after this week's headlines fade.
It is an archive published by DDoSecrets on October 28, 2026, containing details of more than 41,000 Department of Homeland Security employees and contractors, plus more than 55,000 internal permission groups, under the name “Icepick.”
DDoSecrets says the data came from DHS's Okta login system, via a group calling itself the Department of Peace and researcher maia arson crimew. Okta says it has no evidence its data or systems were compromised.
The reporting so far describes work emails, phone numbers, office addresses, job titles, supervisors and permission-group memberships. It does not describe home addresses, and this article does not republish any individual's personal details from the archive.
Their names reference undercover operations, wiretap and intercept programmes, facial-recognition and phone-analysis tools, and AI systems, giving outsiders a map of DHS's surveillance and enforcement capabilities.
DHS and the Justice Department did not respond to WIRED's requests for comment, and DHS did not immediately respond to Reuters and other outlets at the time of reporting.
Related coverage on US News Pulse: the US ban on BGI genomics imports over forced labour, the FEC cyberattack that shut down campaign-finance filings, and Trump's confirmation of the Vance letter to Iran.
Sources: WIRED via DNYUZ, Reuters, TechCrunch and Newsbytes reporting, October 28-29, 2026. This article reports only aggregate, already-published facts and does not reproduce personal data from the leaked archive.
Leave a Comment
| Today's Date:
