Leak details more than 41,000 Homeland Security workers and access groups
Original title: Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents
DDoSecrets published the archive as Icepick; group names reference undercover work, wiretaps, and surveillance tools.
Distributed Denial of Secrets published an archive called Icepick, which it says came from a group calling itself the Department of Peace and from DHS's Okta login system. The records cover more than 41,000 employees or contractors across DHS and seven component agencies, including emails, phone numbers, office addresses, and permission groups. Okta says it has no evidence its systems were compromised. DHS and DOJ did not respond to WIRED.
Unconfirmed: Okta denies a breach of its systems, and DHS has not confirmed the leak's authenticity.
- Records were last updated on August 19, 2026.
- CBP accounts for more than half of the records and ICE about 10,000.
- Nearly 1,000 records are tied to CISA, more than half of them contractors.
- Some HSI groups reference certified undercover operations and wiretap programs.
- Other groups name Palantir Falcon, PenLink, ChatGPT, Gemini, Copilot, and Grok.
Impact: Staff contacts and maps of sensitive DHS access groups
- Vendors
- Okta
- Threat actors
- Department of Peace
- Victims
- U.S. Department of Homeland SecurityImmigration and Customs EnforcementU.S. Customs and Border ProtectionCISA
- Organizations
- DDoSecrets
- Countries
- United States
From the original article
6 min read at wired.com
The leaked records include the locations of ICE and CBP facilities, workers' cellphone numbers, and the members of groups tied to wiretap programs, Palantir software, and xAI’s Grok chatbot.
By Dhruv Mehrotra, Maddy Varner, Dell Cameron · wired.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.