Details of more than 41,000 personnel working for the US Department of Homeland Security, including thousands involved in immigration enforcement, have been leaked to the public.
The leak includes names, work addresses and phone numbers of DHS staff — among them agents working with Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP) — along with descriptions of the work each person does.
What is in it
Most of those included, more than 21,000, work for CBP. Nearly 6,600 work for ICE. Other records cover agents with Homeland Security Investigations, the Federal Protective Service, and people working for the Cybersecurity and Infrastructure Security Agency.
The material also included dozens of previously unknown operation names, the agents who led and worked on them, and some of the technology used in that work, including tools provided by Cellebrite and Palantir.
The information was published in a database named Icepick. A group calling itself the Department of Peace accessed it from DHS; the journalist and cybersecurity researcher maia crimew, alongside the website Distributed Denial of Secrets, put it online.
How they say they got in
The Department of Peace said it accessed the DHS agent profiles through Okta, a single sign-on service organisations use to ensure only authorised people reach internal platforms.
A spokeswoman for Okta said the company is aware of the claims, but added: “Okta is secure, and we have no evidence our data or systems were compromised.”
Those two statements are not necessarily in conflict, and the distinction matters. Single sign-on is a key cut to open many doors: compromise one set of credentials or one misconfigured integration and everything behind it opens at once. That can happen without the sign-on provider itself being breached — the weakness can sit in how a customer configured it, or in one account that should have had less access than it did. Until DHS or Okta says more, nobody outside can tell which.
A DHS spokesperson said the agency is “aware of a potential breach and is actively working to address the situation swiftly and effectively”, adding: “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”
What the groups say it is for
The groups wrote in an online statement that the leak was not meant to be a directory of every DHS agent. The aim, according to Distributed Denial of Secrets co-founder Emma Best, was to replace “anonymity with accountability”.
“The leak is extraordinary but deceptive in its simplicity as it identifies the officials responsible for overseeing covert and undercover operations, the government’s hunt for leakers and the failed BlueLeaks investigation — along with key personnel in DHS’s ever-escalating rendition and deportation programs,” Best added. BlueLeaks refers to a massive leak of US police data in 2020, which DDoSecrets also hosted.
A spokesperson for the Department of Peace pointed directly at the conduct of ICE agents: “On July 17th, Markwayne Mullin said he was ‘turning up the heat’. This is what happens to ICE when you do that.” Mullin became Secretary of Homeland Security in March.
The argument, stated plainly
The context is a public backlash to US immigration enforcement. ICE agents have shot at more than two dozen people this year and killed at least nine, including Alex Pretti and Renee Good, both shot dead in Minnesota despite not being the targets of arrests. Agents often carry out enforcement actions with their faces covered by masks and sunglasses, and rarely identify themselves despite being required by law to do so.
That is a real accountability problem, and it is the one the leakers are answering. But a mass publication of names, home-adjacent work addresses and phone numbers is not a targeted act of disclosure — it is a capability handed to anyone who downloads it, including people with intentions the publishers would disown. The same dataset that identifies who ran a covert programme also identifies a junior CISA analyst who ran nothing.
Both things are true at once, and a reader is not obliged to resolve them.
The third in weeks
Wednesday’s leak marks the third time in recent weeks that a US government agency has been targeted. Last month the FBI was hacked by ShinyHunters, which claimed the names, badge numbers and home addresses of serving agents. In recent days the Federal Election Commission was taken offline over a suspected hacking attempt.
For anyone running single sign-on here — and most organisations of any size now do — the operational lesson is the one in the middle of this story. The provider being secure is not the same as your deployment being secure. The questions worth asking this week are which accounts can reach what, how many of them have more access than the job needs, and whether anyone would notice an unusual pattern of logins before someone else published the result.
