Yesterday·Emerging
Follow-up 3h ago4
95%
Hacker Group Leaks Data on 41,000 US Homeland Security Employees
A hacker group called the Department of Peace has leaked details of more than 41,000 US Department of Homeland Security employees, contractors, and undercover agents, published online by transparency nonprofit DDoSecrets. The breach, which accessed data through DHS's Okta login system with records exfiltrated around mid-August, includes names, contact information, and references to sensitive operational programs. Both DHS and Okta have acknowledged awareness of the incident, though Okta denies any breach of its systems.
Quick Facts
- Leak of personal and operational details of DHS employees
- Data breach via Okta single sign-on system
- Publication of leaked dataset as "Icepick"
- Exposure of undercover agent information and surveillance program names
- References to internal permission groups and operational details
Related Insights
DHS Data Breach Exposes 41,000 Employees, Undercover ICE Agents America First Look · YouTube
Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists FedScoop · YouTube
Did DHS's Own Login System Just Expose Undercover ICE Agents? Red, White & Drama · YouTube
Hackers Leak Work Details on 41,000+ DHS Employees, Including ICE and CBP Staff The Art Of News · YouTube
41,000 Homeland Security Staff Exposed in Huge Data Leak #shorts World Breaking News Daily · YouTube
Hackers Leak Data on 41,000+ DHS Workers, Including ICE #Shorts Breaking News First · YouTube
A hacker group calling itself the Department of Peace has leaked personal and operational details of more than 41,000 employees and contractors working for the US Department of Homeland Security. The data, published online by the transparency nonprofit Distributed Denial of Secrets under the name "Icepick," includes names, job titles, email addresses, phone numbers, office locations, and internal system access details. The breach was made public on Wednesday, October 28, 2026, with records appearing to have been exfiltrated around mid-August.
The leaked dataset covers personnel across DHS and its seven component agencies. More than 21,000 records relate to US Customs and Border Protection (CBP) employees who work at airports and ports of entry. Another approximately 10,000 records involve Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI) unit. Additional records cover employees from US Citizenship and Immigration Services, the Federal Protective Service, and the Cybersecurity and Infrastructure Security Agency (CISA), with nearly 1,000 CISA records belonging to contractors. The leaked information represents roughly one-fifth of DHS's approximately 220,000-person workforce.
According to sources, the hacker group accessed the data through DHS's Okta single sign-on system, which manages employee and contractor access to the department's central network and internal applications. The leaked records include references to internal permission groups and sensitive operational details, including the names of undercover and surveillance programs such as "Keyhole," a certified undercover operation used by HSI, and programs related to wiretapping and surveillance technology provided by companies including Cellbrite and Palantir. In an accompanying note, the Department of Peace stated, "They have our information, so it's only fair that we have theirs."
The data was provided to journalist and cybersecurity researcher maia arson crimew, who shared it with DDoSecrets. According to Emma Best, a co-founder of DDoSecrets, the organization's goal in publishing the breach was to replace "anonymity with accountability" by identifying officials responsible for overseeing covert operations and key personnel in DHS's deportation and rendition programs. A Department of Peace spokesperson referenced actions by Secretary of Homeland Security Markwayne Mullin, who said in July he was "turning up the heat" on immigration enforcement, stating that the hack was a response to such enforcement actions.
Okta has denied any breach of its systems, stating, "Okta is secure, and we have no evidence our data or systems were compromised." DHS acknowledged awareness of the potential breach, with a spokesperson stating the agency is "actively working to address the situation swiftly and effectively" and taking "all security threats against our employees and officers seriously." The breach is the second time DHS has been targeted by hackers in 2026 and follows recent breaches affecting the FBI and Pentagon human resources systems.
Topics
Why This Matters
The breach exposes operational details and personnel information across seven DHS component agencies, affecting approximately one-fifth of the department's 220,000-person workforce. Leaked records include names and contact details of approximately 21,000 CBP employees, 10,000 ICE/HSI personnel, and references to internal surveillance programs and undercover operations. This represents a measurable increase in security exposure for active and undercover personnel and may impact operational integrity of active investigations and surveillance activities. DHS faces documented access vulnerabilities through its Okta single sign-on system, marking the second 2026 breach targeting the agency and following breaches of FBI and Pentagon HR systems.
Timeline & Sources
Jul 17, 2026
WireSecretary of Homeland Security Markwayne Mullin makes statement about "turning up the heat" on immigration enforcement
Aug 19, 2026
WireLeaked DHS records last updated
Oct 28, 2026
WireDDoSecrets publishes leaked dataset as "Icepick" online; breach becomes public
Sources
- Details of thousands of US immigration agents leaked in major hackBBCMediaOct 28, 2026
- Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agentstechcrunchMediaOct 28, 2026
- Leak Exposes 41,000 Homeland Security Workers–Including Undercover ICE Agentswired.comMediaOct 28, 2026
- Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agentstechcrunch.comMediaOct 28, 2026