Data Breach Exposes Personal Information and Operational Data of Over 41,000 DHS Employees

Personal details and internal technical records belonging to more than 41,000 employees and contractors across the U.S. Department of Homeland Security (DHS) have been leaked online.

The leaked dataset, dubbed "Icepick", was published by the transparency non-profit Distributed Denial of Secrets (DDoSecrets) and cybersecurity researcher maia arson crimew. The data was reportedly obtained by an entity calling itself the "Department of Peace," which claimed to have accessed the files through Okta, an identity management service used by federal agencies.

The breach affects personnel across seven constituent agencies within DHS. According to analyses of the dataset, U.S. Customs and Border Protection (CBP) staff account for over half the records, with more than 21,000 entries. U.S. Immigration and Customs Enforcement (ICE) accounts for nearly 10,000 records, while U.S. Citizenship and Immigration Services (USCIS) accounts for roughly 6,200. The files also contain information on personnel from Homeland Security Investigations (HSI), the Federal Protective Service, and the Cybersecurity and Infrastructure Security Agency (CISA).

In a statement addressing the incident, a DHS spokesperson stated:

“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”

An Okta spokesperson maintained that the company's internal systems remain intact:

“We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised.”

Beyond basic workplace directory information such as full names, job titles, phone numbers, email addresses, and office locations, the archive includes more than 55,000 permission group names. These groups provide a map of reporting hierarchies, field office operations, and access permissions for specialized software tools.

Key operational details revealed in the data include:

• Surveillance and Analytical Software: Permission groups reference platforms used to collect and process data, including Palantir's Falcon investigative platform, PenLink, and Mobile Fortify, a facial recognition application utilized by field agents.
• Undercover and Wiretap Programs: Entries detail personnel enrolled in certified undercover operations, wiretap programs like the Title III Intercept Program, and the Communications Intercept Center TechOps Program.
• Artificial Intelligence Access: Specific permission lists outline access to commercial AI models including ChatGPT, Gemini, Copilot, and Grok for technology officials and senior leadership.
• Inter-Agency Support: The dataset highlights specialized units, including National Guard members, Department of Defense personnel providing military processing support at ICE facilities, and local law enforcement officers designated under 287(g) agreements.

Commentators on national security noted that the compilation could pose risks if analyzed by external actors. Alexander Leslie, a national security expert at threat intelligence firm Recorded Future, said:

“If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS. This dataset becomes way more valuable when correlated with previously compromised information, commercial data, and other intelligence collections”

“An adversary could spend months exploiting these relationships to identify vulnerable personnel, develop convincing impersonation attempts, or compromise ongoing investigations.”

The "Department of Peace" hacker group framed the release as a direct response to recent federal enforcement actions:

“On July 17th, Markwayne Mullin said he was 'turning up the heat'. This is what happens to ICE when you do that.”

Emma Best, co-founder of DDoSecrets, stated the publication was intended to replace "anonymity with accountability".

"The leak is extraordinary but deceptive in its simplicity as it identifies the officials responsible for overseeing covert and undercover operations, the government's hunt for leakers and the failed BlueLeaks investigation - along with key personnel in DHS's ever-escalating rendition and deportation programs,"

Cybersecurity researcher maia arson crimew, who built a searchable portal for the dataset, defended making the information accessible: “I don't think we should let them scare us into not looking into them.”

Addressing the legal aspects surrounding public employee data, Adam Steinbaugh, a senior attorney at the civil liberties group FIRE, remarked:

“This is information that would be on a business card. That’s not something the government can criminalize."

The incident marks the third major cyber incident targeting U.S. federal agencies in recent weeks, following reported breaches at the FBI and an outage at the Federal Election Commission.