What was in the DHS Icepick leak?
On 28 October 2026, the transparency group Distributed Denial of Secrets published a database it calls Icepick. The archive identifies more than 41,000 employees and contractors at the US Department of Homeland Security, according to the BBC and the Guardian. DDoSecrets lists the download at 166.70 MB.
The records include names, work email addresses, phone numbers, office addresses, job titles and membership of internal DHS groups. More than 21,000 of the people identified work for Customs and Border Protection, the BBC reported. About 6,600 work for Immigration and Customs Enforcement. Others appear from Homeland Security Investigations, the Federal Protective Service, US Citizenship and Immigration Services and the Cybersecurity and Infrastructure Security Agency.
Icepick is more than a staff directory. The data includes dozens of previously unknown operation names and identifies agents who led or worked on them, the BBC reported. It also points to some of the technology agents used, including tools from Cellebrite and Palantir.
Internal directory groups add another layer. Malwarebytes reported that more than 200 CBP users appeared in a group with access to Mobile Fortify, a facial recognition tool. Other groups referenced Penlink, a service the company says can track mobile-device location data. Membership lists like these describe who can reach which system, not just who works where.
The files also span staff at nearly 7,000 offices, Malwarebytes reported. That reach helps explain why the leak matters beyond headquarters. Field offices, regional units and support staff all appear in the same directory structure, so a single archive can map relationships across the agency.
The published fields are mostly work-related. Malwarebytes noted that Icepick revealed less sensitive information than the FBI heist, which reportedly included Social Security numbers, medical records and home addresses. That does not make the DHS data harmless, because work contact details can still be cross-referenced.
How did the Department of Peace say it got the data?
A hacktivist group calling itself the Department of Peace says it obtained the records from an Okta single sign-on service used by DHS. The group passed copies to DDoSecrets and to the Swiss researcher and activist maia arson crimew, according to the BBC and NPR.
Crimew built a searchable version of the data and cleaned and enriched the raw files, DDoSecrets said. That detail matters for anyone assessing the leak. A searchable interface can add context, but it can also mix outside material into the original records.
Okta disputes the account. "Okta is secure, and we have no evidence our data or systems were compromised," a company spokeswoman told the BBC. The claim that DHS's Okta service was the entry point has not been independently confirmed. DHS itself described a potential breach rather than a confirmed one.
The distinction between a breached identity provider and a misused account is important. Single sign-on systems centralise access, so they are valuable targets. But an attacker can also abuse stolen credentials, session tokens or misconfigured access without breaking the provider's core systems. Neither DHS nor Okta has published a forensic account that settles the question.
Okta is an identity provider, which means it checks credentials and issues access to many separate applications. A compromise there would be serious, but so would a stolen DHS account or a misconfigured directory sync. The public evidence so far does not distinguish between those scenarios. That ambiguity is why the company's denial and the group's claim can coexist without either side producing a definitive timeline.
Why are immigration agents' identities sensitive?
DHS employees named in the data include staff tied to surveillance, computer forensics, undercover work and deportation operations. The Guardian reported that the files reference operation names, surveillance programs and undercover initiatives. Immigration agents often work with their faces covered and without visible identification.
That makes the leak a safety question as well as a transparency one. Officers and contractors could face harassment, stalking or retaliation if their work details are linked to enforcement actions. Malwarebytes warned that the data could enable targeted scams, threats or physical harm. Family members may be exposed through address and phone records.
Supporters of publication frame it differently. DDoSecrets co-founder Emma Best said the aim was to "replace anonymity with accountability." She argued that Icepick identifies people who shape DHS policy and operations, not every employee. Journalists and advocates say such records can support freedom-of-information requests and congressional oversight.
Both claims can be true at once. The same file can help a reporter trace responsibility for a program and help someone else locate an individual officer. That tension sits at the centre of nearly every leak involving government personnel data.
The BBC noted that immigration agents rarely identify themselves, despite a legal requirement to do so, and that politicians have demanded DHS enforce the rule. That context shapes the transparency case for the leak. It also raises the stakes for agents who say masks and anonymity protect them from retaliation.
Best called the leak "extraordinary but deceptive in its simplicity." By that she meant the records look mundane, yet they connect names to covert operations and internal reporting lines. A list of job titles can reveal more than a list of phone numbers when it is read alongside an agency's chain of command.
How reliable is the leaked data?
DHS has not confirmed the authenticity or completeness of the archive. "We are aware of a potential breach and are actively working to address the situation swiftly and effectively," a DHS spokesperson told the BBC. The department said it takes threats against employees seriously and would update the public when more information was available.
The fuller statement also said DHS takes "all security threats against our employees and officers seriously" and would work to ensure they are properly protected. It did not publish a notification timeline, a count of affected contractors or a forensic summary. Those omissions leave employees and outside researchers to work from the leaked files themselves.
Independent checks are partial. Reuters said it matched personal information for about six DHS employees in the leak to credit bureau records and breach data held by a dark web intelligence platform. That supports the view that at least some records are genuine. It does not prove that every row is accurate or current.
The publishers also say the dataset is not a full staff list. TechCrunch reported that timestamps on the records suggested the data was taken around mid-August, according to Malwarebytes. The searchable version adds automated and manual research, so some displayed details may not come from DHS at all.
Attribution is a separate claim. The Department of Peace says it carried out the theft, and it previously claimed responsibility for DHS contract documents in March. No court finding or official investigation has established that account. Readers should treat the group's motive and methods as statements, not established facts.
One more caveat concerns scale. NPR described the archive as roughly a fifth of a DHS workforce it put at 220,000 people. Even if that estimate is right, the leak is partial. It may still be representative enough to reveal structure, but it cannot support claims about every office or every employee.
How does Icepick fit into a wider run of US agency breaches?
The leak is the third government data disclosure to make headlines in about a month, the Guardian reported. In September, the ShinyHunters group claimed to have stolen FBI data including job details and medical information.
The comparison with the FBI case matters for risk assessment. Financial identifiers such as Social Security numbers are hard to replace; work contact details are easier to change but more useful for social engineering. The two breaches therefore pose different problems, even when the record counts look similar.
The Defense Department lawsuit, reported by the Guardian, followed a breach affecting millions of current and former military personnel. Together, the cases show that personnel systems, not only customer databases, have become a front line in US government security.
Other incidents point to the same weak point. The BBC reported that the Federal Election Commission was taken offline after a suspected hacking attempt. DDoSecrets also published BlueLeaks, a large cache of US police data, in 2020.
The common thread is identity data rather than exotic malware. Personnel files, directory groups, contact lists and access records tell an attacker who exists, what they do and which systems they can reach. That information supports phishing, credential theft and physical targeting long after the initial breach.
Directory data is also relational. A phone number is modest on its own, but a name linked to a unit, a manager and a software group becomes a map of who approves access and who supervises whom. That is why the leak's internal group memberships may matter more than its contact fields.
For DHS, the exposure also arrives during a heated debate over immigration enforcement. CNBC reported that DHS completed about 980,000 deportations in the first 18 months of President Donald Trump's second term, citing the Migration Policy Institute. The BBC reported that ICE operations have repeatedly turned violent, with agents shooting at more than two dozen people and killing at least nine this year.
What does the leak mean for DHS employees and the public?
For affected staff, the practical risks are phishing, impersonation and unwanted contact at work or home. Malwarebytes advised employees to follow agency guidance, verify unexpected messages and report threats to security teams. Anyone whose details appear should assume that work contact information is public.
Malwarebytes also warned that basic identity fields can be cross-referenced with credit bureau records and other breach data, which amplifies the risk. The searchable version's added research means an employee's profile may contain details that DHS never held. That makes it harder for an individual to correct the record.
For oversight groups, the more durable value is structural. The files can help identify which office handled a program, which contractor supported it, and where responsibility sat. That is the kind of context that ordinary freedom-of-information requests often fail to produce.
For the public, the leak cuts both ways. It offers an unusual view of how a large security agency is organised, including which units handle surveillance and which contractors support them. It also creates a template for future dumps that may contain far more sensitive material.
Legal exposure may grow. Employees may argue the department failed to protect their data, though any claim would depend on contracts, notices and applicable law. Public reporting does not say whether DHS has begun notifying affected workers. The Guardian reported that the department has also pressed to unmask its critics while defending agents' right to remain anonymous.
That asymmetry is central to the accountability argument. If the government does not disclose agents' identities during enforcement, a leak becomes one of the few ways outside researchers can map responsibility. The same logic does not erase the privacy and safety costs for the individuals named.
What happens next?
The immediate questions are confirmation and scope. DHS has called the incident a potential breach, not a proven one, and has not published a figure for how many records it believes are authentic. Okta has denied a compromise but has not explained how the data might otherwise have left DHS systems.
Investigators will likely examine sign-on logs, device records and the permissions attached to the leaked directory groups. They will also ask whether contractors or third-party services had access to the same personnel data. Those details will determine whether this was a single account takeover or a broader identity-layer failure.
Oversight is the second track. Congressional committees, journalists and freedom-of-information requests can use the data to examine DHS operations, but they will need to separate verified records from enriched material. Employees and unions may push for notification, credit monitoring and stronger controls on directory data.
The final question is whether more releases follow. The Department of Peace has shown it can assemble and distribute large files, and it has targeted DHS before. Until DHS and Okta provide a fuller account, the safest conclusion is narrow: a large cache of personnel data is public, some of it checks out, and the dispute over how it left the building is unresolved.
Several developments over the coming weeks would change that picture.
- •Whether DHS confirms the breach and publishes a notification plan for affected staff.
- •Whether Okta releases forensic findings about the claimed sign-on path.
- •Whether congressional committees request testimony or documents from DHS and Okta.
- •Whether more DHS files appear, including contract documents the group says it obtained in March.