The nonprofit group Distributed Denial of Secrets published data on Wednesday said to cover more than 40,000 employees of the Department of Homeland Security, including people working in surveillance, intelligence and undercover operations.1,2,3,4,5,7
The release includes names, phone numbers, email addresses and job titles for personnel across several DHS components, along with email groups and permission groups that indicate assignments to special operations, surveillance jobs, computer forensics and undercover work. The department said it was aware of a potential breach and was working to protect employees.2,5,7
Ars Technica put the figure at more than 41,000 employees or contractors, spanning DHS itself and seven component agencies including Immigration and Customs Enforcement and Customs and Border Protection, with records last updated on August 19, 2026. According to an analysis of the data, Customs and Border Protection staff account for more than half of the records, ICE accounts for about 10,000, roughly a third of them in Homeland Security Investigations, another 6,200 belong to U.S. Citizenship and Immigration Services, and nearly 1,000 are tied to the Cybersecurity and Infrastructure Security Agency, more than half of them contractors.5
The files also contain office addresses and references to internal systems, and altogether cover about a seventh of the DHS workforce, revealing how the department is structured from senior leadership to individual immigration agents and detention contractors. There are more than 55,000 permission group names in all, which appear to reference tools for accessing immigration court records, pulling data from seized phones and conducting surveillance, including Palantir's Falcon investigative platform and PenLink, which analyzes phone records and social media.5
Distributed Denial of Secrets said the information was obtained by an entity calling itself the Department of Peace and provided to the group and to hacktivist and journalist maia arson crimew. The group calls the archive "Icepick." In a press release, it said the data is from the department's Okta login system, and co-founder Emma Best said the Department of Peace harvested the data from the Okta sign-on service used by DHS. Okta said it was unaware of any breach of its systems. "Okta is secure, and we have no evidence our data or systems were compromised," an Okta spokesperson said in response to a query.2,5,7
Reuters could not immediately corroborate the claim and could not immediately verify the authenticity of the entire trove, but it was able to match personal information about six DHS employees named in the leak to credit bureau records and breach data carried by the dark web intelligence platform District 4 Labs. Reuters called three DHS employees directly and was able to confirm their phone numbers and other details. One said it was the first they had heard of a breach. In several cases, the data tracked information available on employees' LinkedIn profiles, but in others it revealed nonpublic data about internal organization charts or previously undisclosed programs or operations.2
A Homeland Security spokesperson said, "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively," adding, "We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available." The Justice Department did not respond to a request for comment, and the FBI referred the inquiry to DHS.2,5,7
Best said crimew developed a search tool for the data that would allow the public to browse it. Best said the tool would "replace anonymity with accountability" and empower journalists, guide public records requests and boost congressional oversight. Crimew said her tool would provide "FOIA material for years to come!" Crimew added, "I don't think we should let them scare us into not looking into them."2,5
The Department of Peace did not immediately respond to a request for comment, but in a statement included with the data it said that DHS employees "have our information, so it's only fair that we have theirs" and that it hoped the data "can be used to limit further harm by the DHS and supports all efforts in that direction." In March, the Department of Peace claimed responsibility for hacking DHS and posting documents related to contracts with outside vendors.2,5
The disclosure was described as the third major government data leak to make headlines in the past month. In September, the hacking group ShinyHunters claimed the theft of a massive trove of data from the FBI, including sensitive job details and medical information from thousands of bureau employees. Law enforcement agencies have arrested several suspects and detained another who is alleged to be part of the group. Last week, the Defense Department was hit with a class action lawsuit following a breach that exposed data on millions of current and former military personnel.2,5,7
At Homeland Security Investigations, 39 employees across more than a dozen field offices belong to groups whose names include "CUC," which government court filings say stands for "certified undercover operation." Another group, apparently based in HSI's St. Paul, Minnesota, area of operations, references "Keyhole," which federal court filings describe as a certified undercover operation. Others reference a "Communications Intercept Center TechOps (CICTO) Program," a "Title III Intercept Program" for wiretaps and an "Illicit Sensor Intercept Program (ISIP)."5
Two permission groups, named "Executive Leadership" and "AI Access," appear to list people given exceptions to the department's web filter and contain the same 13 people, including former DHS head Kristi Noem; Antoine McCord, the recently departed DHS chief information officer; Philip Hegseth, listed as a senior adviser to the DHS secretary and the younger brother of Defense Secretary Pete Hegseth; and Jayce Krachenfels, listed as a policy adviser. Other groups named in the leak reference AI tools, including OpenAI's ChatGPT, Google's Gemini and Microsoft's Copilot. One, called "Grok.com," includes eight DHS technology officials, including the department's former chief information officer and chief data officer. Noem, McCord, Hegseth and Krachenfels did not respond to a request for comment.5
