Homeland Security data leak exposes records of more than 41,000 workers as department investigates

The US Department of Homeland Security is investigating a major data leak that has reportedly exposed records involving more than 41,000 employees and contractors. The exposed information includes thousands of Immigration and Customs Enforcement (ICE) and Border Patrol personnel and several undercover agents.

On October 28, the nonprofit Distributed Denial of Secrets published a collection of DHS records under the name Icepick. A group calling itself the Department of Peace claims it obtained the information by gaining access to internal government systems. The records reportedly cover DHS and seven of its component agencies, including ICE and US Customs and Border Protection (CBP).

The files contain employee names, agency email addresses and workplace locations. They also include phone numbers, some identified as cell phone numbers, along with supervisors and internal access-group memberships. It has not been established that employees' private home addresses were included. CBP accounts for more than half the records, roughly 10,000 involve ICE, and another 6,200 are tied to US Citizenship and Immigration Services. The records were last updated on August 19, so some assignments may have changed.

One of the most alarming findings involves internal groups associated with undercover investigations. WIRED identified 39 Homeland Security Investigations employees connected to access groups referencing certified undercover operations. Other groups reference communications interception programs and surveillance technology.

Former acting ICE director John Sandweg called the exposure a 'nightmare scenario'. He warned that revealing agents' identities could put people in danger and interfere with criminal investigations. Membership in an internal access group does not, however, automatically confirm that every person listed was working undercover.

The leaked records also reveal internal access groups referencing technology used for investigations and government operations. Some groups mention Palantir's Falcon investigative platform, while others reference surveillance-related software, including tools used to examine phone records.

Artificial intelligence tools appear as well. WIRED found groups mentioning OpenAI's ChatGPT, Google's Gemini and Microsoft's Copilot. One group labeled 'Grok.com' included eight DHS technology officials. Group names can reflect access permissions rather than actual activity, so this does not prove the employees actively used the services.

The group claiming responsibility says it accessed the information through DHS's Okta sign-in system. Okta, which provides identity and access-management technology, says it has no evidence that its own systems or data were compromised. That leaves the actual entry point unresolved.

DHS has acknowledged a potential breach and says it is investigating. A DHS spokesperson said: 'DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.' It has not been confirmed that employee passwords, intercepted communications or investigative case files were included.

As the records spread online, DHS moved to limit access. On October 29, a company reportedly authorized to seek content removals on behalf of ICE contacted Icelandic hosting provider FlokiNET, warning that the database exposed more than 40,000 identifiable individuals to potential harassment and physical harm. The hosting company declined to remove the material, saying the records contained workplace contact information rather than private home contact details. The database briefly became inaccessible before appearing again elsewhere.

On October 30, SITE Intelligence Group had reportedly identified threatening online rhetoric following the release. Some social media users reportedly threatened immigration officers and their families.