Oct 28, 2026 4:00 PM
Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents
The leaked records include the locations of ICE and CBP facilities, workers’ cell phone numbers, and the members of groups tied to wiretap programs, Palantir software, and xAI’s Grok chatbot.
An unprecedented leak of Department of Homeland Security records has exposed details of more than 41,000 employees or contractors who work for the department and its constituent agencies. The records include email addresses, phone numbers, and office addresses, but also references to internal systems and sensitive information on undercover and surveillance programs. In all, the leak provides a map of how DHS is organized and how it operates.
The records, which span DHS itself as well as seven component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection, were last updated on August 19, 2026. The transparency nonprofit Distributed Denial of Secrets and cybersecurity researcher and journalist maia arson crimew previewed the data for WIRED, which they say they obtained from a group calling itself the Department of Peace.
DDoSecrets published the archive, which it calls “Icepick,” on Wednesday. In a press release, DDoSecrets says the data is from DHS’s Okta login system. In a note with the files, the hackers wrote, “They have our information, so it’s only fair that we have theirs.”
An Okta spokesperson tells WIRED that it is unaware of any breach of its systems. “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised,” the spokesperson says.
The leak comes as DHS has aggressively pursued its critics, seeking to unmask anonymous social media users, obtain customer records on protesters, and secure warrants for surveillance tools aimed at reporters. Since the start of the second Trump administration, DHS and the federal government have moved to hide DHS employees’ names and faces. The agency has also expanded its definition of “doxing”—a term that typically refers to publishing someone’s home address and other personal details for malicious purposes—to encompass the publication of basic facts about public employees, like their names and titles.
The leak follows a breach in which a group of hackers known as ShinyHunters claimed to have stolen personal information on nearly every FBI employee and their families. Law enforcement agencies have arrested several suspects and detained another who is alleged to be part of the group.
The DHS records are searchable on a website crimew built. “I don’t think we should let them scare us into not looking into them,” she tells WIRED.
“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a Homeland Security spokesperson tells WIRED. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”
The DOJ did not respond to WIRED’s request for comment. The FBI referred WIRED’s inquiry to DHS.
According to a WIRED analysis of the data, CBP staffers account for more than half of the records. ICE accounts for about 10,000, roughly a third of them in Homeland Security Investigations, ICE’s investigative wing. Another 6,200 belong to US Citizenship and Immigration Services, and nearly 1,000 are tied to the Cybersecurity and Infrastructure Security Agency, more than half of them contractors. Altogether, the files cover about a seventh of DHS’s workforce, revealing how DHS is structured, from senior leadership down to individual immigration agents and detention contractors.
Like most large organizations, DHS uses permission groups to control access to internal systems, according to the leaked records. Nearly everyone named in the leak has access to at least some of these systems. At HSI, 39 employees across more than a dozen field offices belong to groups whose names include “CUC,” which government court filings say stands for “certified undercover operation.” Another group, apparently based in HSI’s St. Paul, Minnesota, area of operations, references “Keyhole,” which federal court filings describe as a certified undercover operation that recently funded HSI’s undercover surveillance of Minneapolis protest groups earlier this year. Others reference a “Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program” for wiretaps, and an “Illicit Sensor Intercept Program (ISIP).”
The names of the groups—there are over 55,000 in all—appear to reference tools for accessing immigration court records, pulling data from seized phones, and conducting surveillance. These include Palantir’s Falcon investigative platform and PenLink, which analyzes phone records and social media.
Two permission groups, named “Executive Leadership” and “AI Access,” appear to list people given exceptions to DHS’s web filter, which blocks some websites for employees. They contain the same 13 people, including former DHS head Kristi Noem; Antoine McCord, the recently departed DHS chief information officer who has returned to defense tech company Anduril; Philip Hegseth, listed as a senior adviser to the DHS secretary and the younger brother of defense secretary Pete Hegseth; and Jayce Krachenfels, listed as a policy adviser, who previously worked as a regional field director for Donald Trump’s 2024 presidential campaign, according to his LinkedIn profile. Noem, McCord, Hegseth, and Krachenfels did not respond to a request for comment
Other groups named in the leak reference AI tools, including OpenAI’s ChatGPT, Google’s Gemini, and Microsoft’s Copilot. One, called “Grok.com,” includes eight DHS technology officials, including the department’s former chief information officer and chief data officer.
“If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS,” says Alexander Leslie, a national security expert at the threat intelligence company Recorded Future. “This dataset becomes way more valuable when correlated with previously compromised information, commercial data, and other intelligence collections. An adversary could spend months exploiting these relationships to identify vulnerable personnel, develop convincing impersonation attempts, or compromise ongoing investigations.”
More than 700 accounts are associated with a group apparently referencing Signal, the encrypted messaging app, nearly all belonging to CBP personnel. More than 200 CBP accounts belong to a group referencing Mobile Fortify, a face-recognition app that immigration agents use to identify people. The group includes field supervisors, special response team operators, and tactical and intelligence agents. About half are in Texas, California, and Arizona.
Roughly 1,300 ICE enforcement accounts have been created since July 4, 2025, when Trump signed the One Big Beautiful Bill Act, which funded the hiring of 10,000 new ICE Enforcement and Removal officers by the end of 2025.
Nearly 20 accounts appear to belong to personnel with the Department of Defense, which the administration styles as the Department of War; eight are in a group titled “ICE Tip Line DOW Surge.” About 170 accounts are listed as providing “military processing support” at ICE facilities, and 35 others explicitly identify National Guard members.
Dozens of accounts have job titles like “Designated Immigration Officer” and “287(g) Officer,” which mark local law enforcement personnel authorized to carry out some immigration enforcement duties. Many list county sheriff’s offices and jails as their workplaces. The records also include roughly 4,400 “associates,” whose jobs range from IT developers and data scientists to nurses and detention officers. Of those, 145 are named as a “contractor” or “high risk contractor.”
More than 300 records reference senior titles associated with DHS headquarters, from Noem down through deputy undersecretaries, assistant secretaries, and chiefs of staff to officials overseeing intelligence, technology, biometrics, and privacy. Most records also name a supervisor, which could allow anyone analyzing the dataset to reconstruct reporting relationships across the department.
The Trump administration has prosecuted protesters for posting information about individual ICE officers and warned others for doing so. In June, 15 Minnesota residents were charged under laws related to stalking and threats of violence, which prosecutors linked to their participation in ICE-opposition activities. More than 100 HSI agents, including undercover operatives, took part in an operation that included widespread surveillance and infiltration of group chats.
Adam Steinbaugh, a senior attorney at the nonprofit civil liberties group FIRE, says that the Trump administration has taken an expansive view of 18 USC 119, a law that prohibits people from sharing “restricted personal information” about federal officers or their families with the intent to threaten them.
“This is information that would be on a business card,” says Steinbaugh of the names and basic work details included in the archive. “That’s not something the government can criminalize."
Despite the potential sensitivity of other records in the leaked data, the creators of Icepick do not consider it doxing. They see it as an accountability tool.
“The DHS especially as an agency completely lacks accountability, despite many parts of it being incredibly unpopular. The people who work there know this too; for example, some of their LinkedIn bios simply say ‘stuff at US Government,’” says crimew. “If they weren’t hiding their involvement in the repressive arm of the US government, there would be no need for us to expose them in the first place.”
I’ve downloaded the ICE database but can’t seem to read any of its files, anyone got any clue how to treat those ?
you sure your download isn’t corrupted? they’re all json files.
deleted by creator
They should have done this voluntarily. We have a right to know who our public servants are.
39 employees across more than a dozen field offices belong to groups whose names include “CUC,” which government court filings say stands for “certified undercover operation.”
The DHS records are searchable on a website crimew built.
I only skimmed after this. Is there a link?
Edit: think it’s this but it seems to be having issues - https://icepi.cx/
holy bingle
"…Okta is secure, and we have no evidence our data or systems were compromised,”
Odd. You have been presented with evidence that your data and system have been compromised. And https://en.wikipedia.org/wiki/Stuxnet helps prove that no network is totally secure.
It’s entirely possible that the geniuses in charge of DHS had a totally insecure master admin password and security policy that allowed access to Okta management. The front door lock can still be called “secure” if the owner just left the back door open.
it could have been an inside job.
if okta has a halfway decent IT department, they’d be able to find that. it’d be the one non-DHS IP address in their access logs.
So someone with a master password was phished. That doesn’t really make it insecure. Someone had admin rights and they were stupid enough to be phished.
You can’t fix stupid
Or maybe whoever was supposed to secure it was doge’d.
You can’t fix stupid, but you can build systems to help mitigate it. Rate limiting, alarms/pattern monitoring etc. unsurprisingly the fascists are too stupid to do any of that, even with their infinite corrupt budget.
The front door lock can still be called “secure” if the owner just left the back door open.
That’d not even a back door. That’s just them leaving the key to the front door under a doormat.
It’s probably more like they gave the key to someone who told them they were the key inspector.
True. When I was a network administrator I didn’t consider my network to be secure and I don’t trust my home network to be. I do what is feasible and hope that things work out.
May they all have the days they deserve…
May the rightful condemnation and judgement follow them for the rest of their lives.
I gotta start checking this list before giving job interviews.
👇FAFO
Straight into my v…er public consciousness!
Eh, they’ll be fine. It’s not like Americans seem inclined to do anything about their own situation, let alone risk anything for the people interned in ICE’s happy-happy joy-joy cage camps.
Are you trusting our media to show whats actually going on?
I don’t get what you expect us to do. We’re protesting constantly, we’re organizing politically (very successfully it seems like, we’ll find out in a few weeks), we’re destroying flock cameras and physically driving out ICE from our communities. Hell, there’s even been a steady stream of assassination attempts.
We’re the furthest along, but this infection is global. Billionaires have taken control of our government and media, and we’re trying to regain control. It’s not an easy process.
And money is global, do when you face the same battle I’ll be supportive
Also, just from a geographic perspective, our states are so far apart. We can march in major cities. We protest regularly. No one cares. So, everyone would have to get to the capitol to be seen and to organize that on that scale is incredibly difficult and right now the average person can’t take a day off because of the state of the economy. Realistically, people are doing what they can, but the corruption is too deep. The propaganda has brainwashed a lot of people, but even the most absorbed are waking up. Eventually there will be a proper breaking point here.
I’m sorry but no, you don’t. I’m tired of this excuse, you don’t protest regularly, I live here, I’ve seen the “protests”.
You know what country is as big as th US? Brasil. You know what country has a police that is more violent than the US’s, that kills more than the US’s, and that is as militarized as the US’s? Brasil. Look at our organic, instantaneous protests and show of strength after bolsonaro jr came out ahead in the 1st round of elections.
“oh major cities” shut up, we had demonstrations everywhere, big and small cities alike
and give your compatriots proper credit, was the civil rights movement a collective hallucination? “oh too far back in time”
BLM then, did that not happen? those were protests. the no kings parade is a joke
Thanks for letting everyone know you have nothing but contempt for any American
You are wrong, I don’t have contempt, I feel pity and annoyance.
It reads as rage and accusatory. Doesn’t seem very understanding at all.
I don’t see contempt in their post but if they do then it’s well deserved contempt after what we just did to Brazil.
Yes because citizens who oppose their government equal their government. I’m just glad people are such clear headed thinkers on Lemmy. It’s a constant thing to lump huge numbers of people together who happen to have a birthplace in common
This was really a productive conversation. I’m glad things worked out so well for you and i wish nothing but success to you and your country in the future. But in case things ever don’t work out the way you want, remember the advice you gave me. Shut up.
They haven’t worked out yet, your country will try it’s darnest that it doesn’t. So go and vote, and go and actually demonstrate. Stop finding excuses, all eyes are on you; so-called “home of the brave”
You should reconsider your comment given how many Americans have given their lives and/pr freedoms fighting ICE. You’re being disrespectful to them and they don’t deserve that.
This isn’t the time for petty comments like yours.
I have nothing but respect for characters of integrity like Alex Pretti who seemed like one hell of a sterling lad, and sympathy for Renée Good and other like her. Do you really think my comment was directed at those (proportionally far too few) who do act?
Or do you think I was referring to everybody else who still don’t?
Ah ok so you’re only doing worthwhile stuff if you end up dead over it. Got it.
Gee, I dunno. I’m just a dumb American who sees a sweeping generalization when you say things like “It’s not like Americans seem inclined to do anything about their own situation.”
Like seriously? Just own it and stop your petty backpedaling.
Someone is definitely doing something by hacking, leaking, and publishing internal DHS data, and some of them at least are American.
In the spirit of alarmism, I think it is perfectly justified and accurate to refer to the so-called “ICE Detention Centers” as what they are - Concentration Camps - places where ethnic and political groups are concentrated in terrible conditions without adequate legal justification and recourse.
Most Americans lack the education, experience, or means to fully understand and resist this wave of modern fascism, and federal actions are designed to take advantage of that weakness. The rest may be inclined to go along with it. However, it’s a fact that the majority of Americans are not happy with their current government, and I think it’s a mistake to confuse inaction or trepidation with apathy.
If Americans can’t be bothered to show up and vote to these midterms in record turnouts, then I fear you might be right.
Don’t stop there, call their deportation of illegal immigrants to unrelated African countries for what it is - slave trade. Slavery was never outlawed, it was just tucked into the prison and detainment system and called prison labor.
https://sentientmedia.org/people-in-ice-detention-forced-to-work/
https://www.newsweek.com/ice-paying-detainee-workers-1-dollar-per-day-under-scrutiny-10996243
https://www.cbsnews.com/news/latin-american-migrants-deported-liberia/
Moving slaves across international borders does what it has always done: it’s a way to hide, muddle, and ignore any remaining rights and available legal recourse they still had. Some remain detained in now completely foreign countries, cementing their slave status, others remain “free”, a freedom with an implied economic surcharge.
I’m sure you would do something though. Because you implied you would on the Internet. No one is ever full of shit on the Internet. Or unearnedly critical of victims they can blame for their victimhood. Never. Nope.
I don’t understand your downvotes. Your tone aside, the message is true: for decades, they’ve known the names of Donald Trump and dozens or even hundreds of other monsters who walk freely among them, and still do today. I don’t see how this is any better. ICE members are probably mostly just poor people. Meanwhile the rich commit violence against all of them every day and lead happy, healthy lives.
Crabs in a bucket.
Well since you seem to have known for years, what have you done? What did you expect an average person to do? Spread the word? Be shocked by how brainwashed their neighbors have become? We were actively targeted by a propaganda engine that got him into office, not once, but twice, specifically targeting the stupidest and mentally weakest. And the way the bell curve works is that that’s at least half of the people around. More, if the government systematically messed with public education, which they did for decades. I’m glad you’re in a better situation but kicking people when they’re at rock bottom, when they’ve been fighting against this current for years, isn’t the way to go.
Where did he mention expecting anyone to do anything? You sound stupid as fuck acting hurt and antagonizing a random person out of nowhere for stating their opinion.
