More Than 41,000 DHS Employee Records Exposed in Massive ‘Icepick’ Leak

A massive leak of Department of Homeland Security records published Wednesday has exposed personal and work details of more than 41,000 employees and contractors, including staff at Immigration and Customs Enforcement and Customs and Border Protection — and, according to reporting on the files, people tied to undercover operations and surveillance programs.

The searchable database, called “Icepick,” was published by the nonprofit transparency collective Distributed Denial of Secrets (DDoSecrets). The group behind the leak calls itself the Department of Peace, working with cybersecurity researcher maia arson crimew.

What was exposed

The records include names, workplace addresses, phone numbers, job titles and email groups, according to Reuters, TechCrunch, WIRED and NPR reporting on the leak. More than half of the records relate to Customs and Border Protection personnel — more than 21,000 — with thousands more relating to ICE employees. The records were reportedly last updated on August 19, 2026.

Beyond contact details, the files contain references to internal systems and sensitive work: email groups identifying staff assigned to undercover and surveillance programs, dozens of previously unpublicized operation names, and technology tools used by the agencies, including software from Cellebrite and Palantir, according to WIRED’s reporting.

How the data was reportedly taken — and what is disputed

TechCrunch reported that the leak appeared to originate from DHS’s Okta single sign-on system, the service staff use to log in to agency systems. Reuters said it could not independently verify that claim, and Okta said it had no evidence its data or systems were compromised, stating: “Okta is secure, and we have no evidence our data or systems were compromised.”

Reuters and TechCrunch independently validated parts of the dataset by matching records against known DHS employees and contacting some for confirmation. One person contacted by Reuters had not heard about any breach.

DHS said it was “aware of a potential breach and is actively working to address the situation swiftly and effectively,” adding that it is taking steps to “ensure all are properly protected.” The department has not confirmed the full scope of the leak.

Why it matters

DDoSecrets co-founder Emma Best called the leak “extraordinary but deceptive in its simplicity,” because it makes explicit connections between officials overseeing covert and undercover operations and key personnel in DHS’s deportation programs. For undercover staff, a searchable public list of names and assignments can endanger ongoing work and personal safety.

The group behind the leak framed it as retaliation, saying: “They have our information, so it’s only fair that we have theirs.” Others say the data will help journalists and researchers file more effective public-records requests, since those requests often fail without specific names and email addresses.

The leak has already spilled into the platform wars: WIRED reported that Bluesky has been blocking links to the leaked DHS employee records, a moderation decision that itself drew attention to the dataset.

What to watch next

Watch for a fuller DHS statement confirming how the data was obtained, whether the department notifies affected employees, and any law-enforcement response. The key unanswered question is the intrusion itself: when it happened, how long the access lasted, and whether the published records are the full set or only part of what was taken.

Sources: NPR / WCMU, “Hackers expose the identities of more than 40,000 DHS employees” (Oct. 28, 2026); Reuters and TechCrunch reporting on the leak’s origin and validation (via Cape Flats summary, Oct. 29, 2026); WIRED reporting on the dataset contents (Oct. 28, 2026); DHS statement via NPR.