Personal information on more than 41,000 employees of the US Department of Homeland Security, including thousands of immigration enforcement officers, has been publicly released following a significant security breach.
The exposed dataset contains names, work addresses, and phone numbers of DHS personnel across multiple agencies, particularly Immigration and Customs Enforcement and Customs and Border Protection. According to BBC News, the leak surfaced on Wednesday through a group calling itself the Department of Peace, working alongside cybersecurity researcher maia crimew. The information was compiled into a database named Icepick and distributed via a website operated by Distributed Denial of Secrets.
The breach represents the third targeting of a US government agency in recent weeks, following separate incidents affecting the FBI and the Federal Election Commission.
What was exposed in the leak?
WIRED reported that the records span DHS and seven component agencies, with the dataset last updated on August 19, 2026, and include references to internal systems and sensitive surveillance programs. The Verge found that approximately 21,000 records concern Customs and Border Protection employees and nearly 7,000 concern ICE staff. TechCrunch reported the data includes records for roughly 10,000 ICE and Homeland Security Investigations employees and just under 1,000 CISA employees.
The Department of Peace stated that access to the DHS employee profiles was obtained through Okta, a widely-used online security platform that organisations employ to control access to internal systems. A representative for Okta responded to the claims by stating:
Okta is secure, and we have no evidence our data or systems were compromised.
What was the stated purpose of the leak?
The groups behind the release framed their objective as replacing anonymity with accountability rather than creating a simple directory of DHS personnel. Emma Best, a co-founder of Distributed Denial of Secrets, elaborated on this rationale:
The leak is extraordinary but deceptive in it's simplicity as it identifies the officials responsible for overseeing covert and undercover operations, the government's hunt for leakers and the failed BlueLeaks investigation - along with key personnel in DHS's ever-escalating rendition and deportation programs.
How has the breach been verified?
Reuters could not independently verify the full dataset but matched information on six named DHS employees against credit-bureau records and dark-web breach data, providing partial confirmation of the leak's authenticity.
What are the security implications?
According to WIRED, security experts have warned that if authentic and current, the dataset could help attackers identify vulnerable employees, impersonate them, or disrupt investigations. The exposure is particularly sensitive given that immigration enforcement agents frequently operate with concealed faces and without visible identification badges.
The leak also arrives during a period of heightened scrutiny of ICE operations. ICE has been ordered to halt most vehicle stops nationwide after two fatal shootings in Texas and Maine, marking a significant policy shift in response to criticism over use of force during immigration enforcement activities.
What is the broader context?
WIRED noted that the leak comes amid efforts by DHS and the federal government to conceal employees' names and faces, and reflects broadened use of the term "doxing" to include publishing basic information about public officials. This tension between operational security and public accountability has intensified following recent high-profile incidents involving ICE agents.
The Department of Homeland Security did not immediately provide a response to requests for comment regarding the breach. The incident follows a pattern of recent security failures affecting federal agencies, including the FBI hack by a group called ShinyHunters last month, which compromised personal information about thousands of agents, and the Federal Election Commission being taken offline in recent days due to a suspected hacking attempt.
