Leak exposes records on more than 41,000 DHS workers
Original title: Massive leak exposes 41,000 DHS workers and undercover ICE agents
The archive includes emails, phones, office addresses, and groups tied to undercover and surveillance programs.
Distributed Denial of Secrets published an archive it calls “Icepick,” which WIRED says covers more than 41,000 DHS employees or contractors across DHS and seven components, last updated August 19, 2026. DDoSecrets says the data comes from DHS’s Okta login system; a note from the group calling itself the Department of Peace framed the release as reciprocity. Records analyzed by WIRED include permission groups tied to certified undercover operations, wiretap and sensor programs, Palantir’s Falcon, and PenLink. Okta says it has no evidence its systems were compromised, while DHS says it is aware of a potential breach and is working to address it.
Unconfirmed: Okta denies a compromise of its systems, and DHS has only confirmed a potential breach.
- CBP accounts for more than half of the records; ICE about 10,000, USCIS about 6,200, and CISA nearly 1,000.
- At HSI, 39 employees belong to groups whose names include “CUC,” described in court filings as certified undercover operations.
- One group references “Keyhole,” described as funding undercover surveillance of Minneapolis protest groups.
- Two filter-exception groups list the same 13 people, including former DHS head Kristi Noem.
Impact: Employee contacts and internal access and surveillance group names exposed
From the original article
7 min read at arstechnica.com
The leak reveals undercover agents, surveillance groups, and sensitive DHS access.
By Dhruv Mehrotra, wired.com · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.