The US Department of Homeland Security (DHS) is investigating a data leak involving records of more than 41,000 employees and contractors, including personnel associated with Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP).
The records were published on October 28, 2026, by the nonprofit Distributed Denial of Secrets under the name “Icepick”. A group calling itself the Department of Peace claimed responsibility for obtaining the information from internal government systems.
- A dataset contains information on more than 41,000 Department of Homeland Security employees and contractors across DHS and seven component agencies.
- Exposed records include work contact details, office locations, reporting relationships and internal access groups referencing undercover operations, surveillance systems and AI tools.
- DHS is investigating the incident. Hackers claim they accessed records through an Okta-based login system, but the entry point remains unconfirmed.
The dataset includes employee names, agency email addresses, telephone numbers, workplace locations, supervisors and internal access-group memberships, according to FOX News.
Some records reference sensitive investigations, surveillance technology and artificial intelligence services used or potentially accessible within DHS.
The department acknowledged a possible security breach but has not confirmed how the information was obtained.
What information was exposed in the DHS data leak?
The published dataset reportedly covers DHS and seven of its component agencies.
CBP accounts for more than half of the records, while approximately 10,000 are associated with ICE. Another 6,200 records concern employees or contractors connected to US Citizenship and Immigration Services (USCIS).
The information includes:
- Employee and contractor names
- Government email addresses
- Workplace locations and office assignments
- Telephone numbers, including some identified as mobile numbers
- Supervisors and reporting relationships
- Internal access-group memberships
The records were last updated on August 19, 2026, meaning some assignments or contact details may have changed. It has not been established that private residential addresses were included.
The available reporting also does not confirm that passwords, intercepted communications or investigative case files were exposed.
Leaked DHS records reference undercover ICE operations
Some of the records contain internal access-group information associated with sensitive law enforcement activities.
WIRED identified 39 Homeland Security Investigations employees connected to groups referencing certified undercover operations. Other groups contained references to communications interception programs and surveillance systems.
The information also reveals organizational reporting relationships between personnel and departments.
Cyber analysts described the exposure as a “nightmare scenario”, warning that identifying personnel associated with sensitive investigations could endanger employees and interfere with law enforcement operations. However, inclusion in an internal access group does not necessarily mean that an individual was directly involved in an undercover investigation.
Group memberships may reflect permissions, administrative responsibilities or access requirements rather than an employee’s operational assignment.
The leaked records therefore do not establish the specific duties of every person listed.
Palantir, ChatGPT, Gemini and Grok appear in access groups
The dataset also contains references to technology platforms used in government operations. Some internal groups mention Palantir’s Falcon investigative platform, which supports information analysis. Other entries reference surveillance-related software and systems associated with examining telephone records.
WIRED also identified access groups mentioning several artificial intelligence services:
- OpenAI’s ChatGPT
- Google’s Gemini
- Microsoft’s Copilot
- xAI’s Grok
One group labeled “Grok.com” reportedly included eight DHS technology officials. These references do not establish that the employees actively used the services.
They also provide no evidence that Palantir, OpenAI, Google, Microsoft or xAI experienced security breaches.
The records indicate the existence of internal access groups associated with these technologies, without confirming the nature or extent of their use.
How did attackers obtain DHS employee records?
The group claiming responsibility alleged that it gained access through a DHS system using Okta identity and access-management technology.
Okta provides authentication and access controls for organizational applications and employee accounts. The company said it had no evidence that its own systems or data were compromised.
DHS has not confirmed the attackers’ account of how the records were obtained. The department acknowledged the incident and said it was investigating the potential security breach. The department added that it takes threats against employees and officers seriously and would work to protect affected personnel.
No specific software vulnerability or compromised authentication mechanism has been publicly established.
DHS seeks removal of leaked employee records
Following publication of the dataset, efforts were made to restrict its availability online. On October 29, a company reportedly authorized to request content removal on behalf of ICE contacted Icelandic hosting provider FlokiNET.
The request warned that the database exposed more than 40,000 identifiable individuals to potential harassment and physical harm.
FlokiNET declined to remove the material, stating that the records contained workplace contact information rather than private home contact details.
The database briefly became inaccessible before appearing again elsewhere.
On October 30, SITE Intelligence Group reportedly identified threatening online statements following the disclosure. Some social media users allegedly made threats against immigration officers and their families. These reports raised concerns about the potential consequences of making personnel information and internal organizational relationships publicly searchable.
DHS continues investigating the incident, including how the records were accessed and whether additional information was compromised.
The department has not publicly confirmed the attackers’ identity, the method of entry or the full operational impact of the leak.
