Leak Exposes Records of 41,000 DHS Employees and Contractors

A leak of Department of Homeland Security records has exposed details of more than 41,000 employees and contractors across DHS and seven component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection. The transparency nonprofit Distributed Denial of Secrets published the archive, called Icepick, on Wednesday after previewing it for WIRED with cybersecurity researcher and journalist maia arson crimew, and the records include email addresses, phone numbers, office addresses and references to internal systems and sensitive information on undercover and surveillance programs.

What leaked

The records were last updated on August 19, 2026. A WIRED analysis found CBP staffers account for more than half; ICE about 10,000, roughly a third in Homeland Security Investigations; USCIS 6,200; and CISA nearly 1,000, more than half contractors. The files cover about a seventh of DHS's workforce.

The records show DHS permission groups, more than 55,000 in all. At HSI, 39 employees across more than a dozen field offices belong to groups named CUC, which court filings say stands for certified undercover operation. A St. Paul, Minnesota group references Keyhole, described in federal court filings as a certified undercover operation that recently funded HSI undercover surveillance of Minneapolis protest groups. Other groups reference a Communications Intercept Center TechOps Program, a Title III Intercept Program and an Illicit Sensor Intercept Program. Some group names also reference tools for immigration court records, seized phones and surveillance, including Palantir's Falcon and PenLink.

Okta and internal access

DDoSecrets says the data is from DHS's Okta login system. Okta told WIRED it is unaware of any breach and has no evidence its data or systems were compromised. Hackers saying they obtained the data from a group calling itself the Department of Peace wrote: "They have our information, so it's only fair that we have theirs."

Two permission groups, Executive Leadership and AI Access, list the same 13 people with exceptions to DHS's web filter, including former DHS head Kristi Noem and Antoine McCord, a recently departed DHS chief information officer now at Anduril. Other groups reference OpenAI's ChatGPT, Google's Gemini, Microsoft's Copilot and Grok.com, which includes eight DHS technology officials.

Reactions and context

Recorded Future's Alexander Leslie told WIRED that if authentic and current, the data is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS, and an adversary could spend months exploiting relationships to identify vulnerable personnel, develop impersonation attempts or compromise investigations.

DHS and DOJ did not respond to WIRED's request for comment. The leak comes as DHS has pursued critics, sought to unmask anonymous social media users and obtain records on protesters, and sought warrants for surveillance tools aimed at reporters. DHS has also moved to hide employees' names and faces and expanded its definition of doxing to cover basic facts about public employees.

The records are searchable on a website crimew built. FIRE attorney Adam Steinbaugh told WIRED the names and basic work details are information that would be on a business card and the government cannot criminalize it. The creators see Icepick as an accountability tool, not doxing.

Sources: wired.com