Massive leak exposes 41,000 DHS workers and undercover ICE agents

12 sources · 15 articlesFirst reported Oct 28, 2026 · 20:00 UTCUpdated Oct 30, 2026 · 11:33 UTC (10h ago)1

Merged summary · from the lead articleSummaries by Vani AI

The archive includes emails, phones, office addresses, and groups tied to undercover and surveillance programs.

Distributed Denial of Secrets published an archive it calls “Icepick,” which WIRED says covers more than 41,000 DHS employees or contractors across DHS and seven components, last updated August 19, 2026. DDoSecrets says the data comes from DHS’s Okta login system; a note from the group calling itself the Department of Peace framed the release as reciprocity. Records analyzed by WIRED include permission groups tied to certified undercover operations, wiretap and sensor programs, Palantir’s Falcon, and PenLink. Okta says it has no evidence its systems were compromised, while DHS says it is aware of a potential breach and is working to address it.

Key facts

CBP accounts for more than half of the records; ICE about 10,000, USCIS about 6,200, and CISA nearly 1,000.
At HSI, 39 employees belong to groups whose names include “CUC,” described in court filings as certified undercover operations.
One group references “Keyhole,” described as funding undercover surveillance of Minneapolis protest groups.
Two filter-exception groups list the same 13 people, including former DHS head Kristi Noem.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Vendors: Okta Palantir Microsoft
Products: Falcon PenLink Active Directory Mobile Fortify
Threat actors: Department of Peace
Victims: Department of Homeland Security Immigration and Customs Enforcement US Customs and Border Protection U.S. Department of Homeland Security ICE Customs and Border Protection Homeland Security Investigations Cybersecurity and Infrastructure Security Agency U.S. Customs and Border Protection CISA US Department of Homeland Security
Organizations: Distributed Denial of Secrets Cybersecurity and Infrastructure Security Agency US Citizenship and Immigration Services Immigration and Customs Enforcement Customs and Border Protection DDoSecrets ZeroFox FlokiNET CentralNic Bluesky
Countries: United States

Coverage

oldest first · one row per article · UTC

Oct 28, 20:00 UTC · 2d ago WIRED · SecurityFirst report
Leak details more than 41,000 Homeland Security workers and access groups
DDoSecrets published the archive as Icepick; group names reference undercover work, wiretaps, and surveillance tools.
Oct 28, 20:01 UTC · 2d ago TechCrunch · Security
Hacker publishes work data on more than 40,000 Homeland Security employees
The dataset covers CBP, ICE, and CISA contacts plus application-access groups; Okta denies its systems were breached.
Oct 28, 21:33 UTC · 2d ago CyberScoop
Leak site publishes data on more than 41,000 DHS employees
Hacktivists calling themselves Department of Peace say they took an Okta SSO database; Okta denies any compromise.
Oct 29, 03:13 UTC · 1d ago Cyber Security News
DDoSecrets publishes records of 41,000 DHS personnel, including undercover links
The Icepick archive, last updated August 19, lists emails, phones, supervisors, and more than 55,000 permission groups across seven DHS components.
Oct 29, 03:34 UTC · 1d ago WIRED · Security
Bluesky blocks links to a leak of 41,000 DHS employee records
The Icepick archive lists names, contacts, and internal groups, including some tied to surveillance work.
Oct 29, 05:10 UTC · 1d ago GBHackers
Leak exposes personal details of over 41,000 DHS employees
Distributed Denial of Secrets published records it attributes to “Department of Peace”; Reuters matched some entries but not the collection method.
Oct 29, 10:16 UTC · 1d ago Help Net Security
Hacktivists publish records of more than 41,000 DHS employees
The Icepick dataset, published October 28, covers ICE and CBP staff and groups tied to undercover work; Okta denies a breach.
Oct 29, 12:31 UTC · 1d ago Hacker News · security
Hackers expose identities of more than 40,000 DHS employees
DHS called it a potential breach; the set covers about a fifth of a workforce a little over 220,000.
Oct 29, 12:54 UTC · 1d ago SecurityWeek
Department of Peace leaks records on over 41,000 DHS employees
The posted set includes work contacts, job details, and which internal systems each account can reach; Okta denies a compromise.
Oct 29, 12:58 UTC · 1d ago Ars Technica · Security
Leak exposes records on more than 41,000 DHS workers
The archive includes emails, phones, office addresses, and groups tied to undercover and surveillance programs.
Oct 29, 13:43 UTC · 1d ago TechCrunch · Security
Bluesky blocks links to leaked DHS employee data amid takedowns
A hacker obtained more than 40,000 Homeland Security login records with work phones and emails; DHS calls it a potential breach.
Oct 29, 19:41 UTC · 1d ago DataBreaches.net
Published records identify more than 41,000 DHS personnel
The set includes phones, emails, job titles and some surveillance, forensics and undercover roles.
Oct 29, 20:58 UTC · 1d ago CyberScoop
DHS employee archive Icepick returns after registrar takedown
A search tool for records on more than 41,000 employees went dark, then reappeared Thursday under a new registrar.
06:26 UTC · 15h ago Security Affairs
Hacker leaks work contacts for more than 40,000 DHS employees
Records cover CBP, ICE, and CISA staff; the leaker claims an Okta SSO source, which Okta says it has no evidence was compromised.
11:33 UTC · 10h ago Malwarebytes Labs
Hackers publish work details on more than 41,000 DHS employees
The Icepick dump lists ICE, CBP and CISA contacts and internal groups; DHS calls it a potential breach.