Security
Data of 41,000 DHS employees and undercover agents exposed in major leak
Details on Department of Homeland Security workers and sensitive operational information were released by a group claiming responsibility via the Okta login system.
Ars Technica
A sweeping disclosure has compromised the personal and operational records of over 41,000 people working across the Department of Homeland Security and its affiliated agencies. The exposed information encompasses contact details, office locations, and references to internal systems and covert programs used by the department.
What was exposed#
The dataset spans DHS and seven component agencies, among them Immigration and Customs Enforcement and US Customs and Border Protection. Records were last refreshed in mid-August 2026. Beyond standard employee information—email addresses and phone numbers—the release contains sensitive references to undercover operations and surveillance initiatives that reveal the structural organization and operational methods of the sprawling agency.
The transparency organization Distributed Denial of Secrets and security researcher maia arson crimew provided early access to the data, known as "Icepick," ahead of its public posting. A group calling itself the Department of Peace has claimed credit for obtaining the records.
The source and Okta's response#
DDoSecrets attributed the breach to DHS's Okta login infrastructure. In a statement accompanying the release, the actors behind the leak wrote, "They have our information, so it's only fair that we have theirs." An Okta representative disputed this characterization, telling media outlets that the company has found no evidence of a system compromise and maintains that its platforms remain secure.
Timing and context#
The disclosure emerges during a period when DHS has been actively targeting its critics—pursuing unmasking of anonymous social media users, seeking customer information on demonstrators, and securing surveillance warrants. Under the current administration, the agency has moved to obscure the identities of its personnel and has reframed the meaning of "doxing" to encompass disclosure of routine public-servant details such as names and roles.
The incident follows a separate breach attributed to hackers known as ShinyHunters, who claimed to have accessed personal details on nearly all FBI staff members and their relatives. U.S. authorities have arrested multiple individuals and are holding another in connection with that breach.
