Leak Site Posts Records on More Than 41,000 DHS Personnel, Including Some Undercover ICE Investigators
A hacker group calling itself the "Department of Peace" says it took the data through DHS's single sign-on login system; DHS says it is working to address a "potential breach," and Okta says its own systems were not compromised.
A directory of 41,000 names, and a login system in the middle
On Wednesday, Oct. 28, 2026, a leak site posted a searchable database called "Icepick." It holds records on more than 41,000 employees and contractors of the Department of Homeland Security (DHS)[1][2][6]. The entries list names, job titles and office locations. Some also list phone numbers and email addresses[3][4].
The people come from Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), Homeland Security Investigations, the cybersecurity agency CISA, U.S. Citizenship and Immigration Services and DHS headquarters[4][5][9]. Several outlets count more than 21,000 CBP records. Fox News says it independently confirmed that the records name several undercover ICE agents[3].
Two facts sit side by side. The data is now public and cannot be pulled back[1][6]. Yet no one has confirmed how it was taken.
Who says they did it, and why
A group calling itself the "Department of Peace" claimed responsibility[1][2]. It says it got in through Okta, the single sign-on service DHS staff use to log into internal systems[1][10]. Single sign-on means one login opens many different apps.
The group says it gave the data to Distributed Denial of Secrets (DDoSecrets), a nonprofit that publishes leaks. It also says it shared the data with a Swiss hacker known as maia arson crimew[1][6].
The hackers tied the leak to DHS Secretary Markwayne Mullin's July 17 statement that he was "turning up the heat" on immigration enforcement. Their words were: "This is what happens to ICE when you do that"[9][8]. They told Fox that DHS employees "have our information, so it's only fair that we have theirs"[3].
Two statements that may both be true
DHS told Fox it is "aware of a potential breach" and is working to address it "swiftly and effectively"[3]. It also said it will "work to ensure all are properly protected"[3]. Those quotes rest on Fox alone. CyberScoop reported that DHS did not immediately respond to it[8].
Okta says "Okta is secure." It says it has "no evidence our data or systems were compromised"[9][10].
These claims don't have to clash. Analysts point out that in single sign-on, the customer decides what each logged-in user can see. That includes staff directory profiles. So one stolen or misused employee login could pull a large directory without Okta's own systems being hacked[12][7].
Under that reading, the failure sits on the customer's side. Whether a DHS account or setting was misused is exactly what hasn't been confirmed.
Doxxing or accountability
The central dispute is over what to call this. Officer-safety advocates and right-leaning outlets call it doxxing, meaning the publishing of people's identities so they can be targeted[3][13]. DHS's strongest case is practical. An undercover investigator's cover is a working tool. Once the name is public, it can end an investigation and endanger informants as well as the agent. Officers are also civil servants carrying out laws Congress passed. In this view, naming them and their offices invites harassment, not policy debate[3].
The leakers see it differently. They argue that people who run deportation and surveillance programs use public power and should be identifiable[8][14]. DDoSecrets co-founder Emma Best said the aim was to replace "anonymity with accountability." She said the release could support journalism, public records requests and congressional oversight[8]. The hackers say they hope the data can limit further harm by DHS[3].
Each side has a stake. DHS wants to protect staff and ongoing operations. It also has reason to keep the focus on a criminal hack rather than on its own directory setup[3][12]. The hackers want to raise the personal cost of taking part in enforcement and to show that DHS systems are weak[9][8]. They also face a possible federal criminal investigation. DDoSecrets risks fresh legal and political pressure as a publisher of stolen data[1][8].
The people in the middle
One point is easy to lose under both framings. Most of the 41,000 people listed are not undercover agents or senior officials. Many are support, IT or administrative staff with no public role[12].
Their argument is that a clerk's office location sits in the same list as an undercover agent's name. The list lumps them together regardless of what each one does. A work address and phone number lead straight to them[4][12]. They face harassment, phishing and identity-based scams. Some may be reassigned[12][7]. SAN describes the leak as covering about one-fifth of the agency's workforce[9].
Same leak, different headlines
Outlets split on emphasis. Fox News led with "doxxed" and put its own confirmation of undercover agents up front. It gave the highest ICE count, about 10,000, and little detail on the hackers' motive[3]. The Epoch Times also put undercover agents in its headline, though it correctly added "Hackers Say"[13].
The Washington Post and NPR used plainer wording, "posted online" and "expose the identities." They gave space to the hackers' stated motive and the DDoSecrets framing[1][2]. Daily Kos called it a list the hackers "disclose," and left out the safety frame[14].
Outside the U.S., the BBC put the ICE count lower, at about 6,600, and quoted Okta's denial[5]. South Korea's SBS called it "another cyberattack" on a U.S. agency, framing it as a pattern of security failures[16]. IBTimes Singapore reported that the records reveal operation names and tools from vendors such as Cellebrite and Palantir. DHS has not confirmed that[15].
Two questions remain open. DHS hasn't said how a login system let one user collect a directory this size. And it hasn't said what it will do for exposed undercover staff. Congress may ask both[12][9].
Summary
On Wednesday, Oct. 28, 2026, a leak website posted a searchable database of more than 41,000 Department of Homeland Security (DHS) employees and contractors[1][2]. It is called "Icepick." The database lists names, job titles, office locations and, in some cases, phone numbers and email addresses[3][4]. It covers staff at Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), Homeland Security Investigations (HSI), the cybersecurity agency CISA and DHS headquarters[1][12]. Fox News says it independently confirmed that the records name several undercover ICE agents[3].
A hacker group calling itself the "Department of Peace" claimed responsibility[1][2]. It says it got in through Okta, the single sign-on service DHS staff use to log into internal systems[1][10]. It gave the data to Distributed Denial of Secrets (DDoSecrets), a nonprofit that publishes leaks, and to a Swiss hacker known as maia arson crimew[1][6]. The group tied the leak to DHS Secretary Markwayne Mullin's July 17 statement that he was "turning up the heat" on immigration enforcement, saying "This is what happens to ICE when you do that"[9][8]. It also told Fox that DHS employees "have our information, so it's only fair that we have theirs"[3].
DHS told Fox it is "aware of a potential breach" and is working to address it "swiftly and effectively"[3]. Okta says "Okta is secure" and that it has "no evidence our data or systems were compromised"[9][10]. Those two statements do not necessarily conflict. A login service can stay secure while someone misuses one customer's account on it. How the data was actually taken has not been confirmed.
The main dispute is about what the leak is. Officer-safety advocates and right-leaning outlets call it doxxing, meaning publishing people's identities so they can be targeted. In their view it puts agents, undercover investigations and families at risk[3][13]. The leakers and their supporters say the people who run deportation and surveillance programs should not be anonymous[8][14]. Both sides also ask a separate question: how a DHS-wide login system let one user collect a directory of this size[12][7].
The Event
On Oct. 28, 2026, Distributed Denial of Secrets posted a searchable database named "Icepick" with records on more than 41,000 DHS employees and contractors[1][6]. A group calling itself the "Department of Peace" said it got the data through DHS's Okta single sign-on system[1][2]. DHS told reporters it was aware of a "potential breach"[3]. Okta said it had no evidence its systems were compromised[9].
Undisputed Facts
- A searchable database called "Icepick" with records on more than 41,000 DHS employees and contractors was published online on Oct. 28, 2026[1][2][6].
- The records include names, job titles, office locations and, for some people, phone numbers and email addresses[3][4].
- Personnel from ICE, CBP, HSI, CISA, U.S. Citizenship and Immigration Services and DHS headquarters are included. Several outlets count more than 21,000 CBP records[4][5][9].
- A group calling itself the "Department of Peace" claimed responsibility. It said it worked with DDoSecrets and the hacker maia arson crimew[1][2].
- A DHS spokesperson told Fox News the department is "aware of a potential breach" and "actively working to address the situation swiftly and effectively"[3].
- Okta said it was aware of the claims, that "Okta is secure," and that it had "no evidence our data or systems were compromised"[9][10].
- The hackers cited DHS Secretary Markwayne Mullin's July 17 statement that he was "turning up the heat" on immigration enforcement as their motive[9].
The Pressure
Strip away the moralizing and blame. What structural realities persist regardless of which narrative wins?
- Operational security
- Undercover work depends on agents' names staying secret. Once a name is public, it cannot be made secret again. So DHS has to treat every listed undercover role as possibly compromised, whatever the leakers intended[3].
- Identity-system concentration
- Single sign-on puts access to many systems behind one login. That makes logins easier to manage, but one misused account can reach a lot. This is a design trade-off DHS shares with most large organizations[12][7].
- Political escalation over enforcement
- The hackers tied the leak directly to Secretary Mullin's July 17 statement that he was "turning up the heat" on enforcement. That makes the leak part of the wider fight over immigration policy, not a breach for profit[9].
Material realityMore than 41,000 DHS records are now public and searchable, and that cannot be undone[1][6]. Counts by agency differ: about 21,000 CBP records are widely reported, and ICE estimates range from about 6,600 (BBC) to about 10,000 (Fox News)[5][3]. DHS has not confirmed how the data was taken. The hackers say it came through Okta, while Okta says its systems were not compromised. That leaves open whether a DHS account or configuration was misused, which is a different failure from a breach of Okta itself[9][10]. Reports also say the records reveal operation names and tools from vendors such as Cellebrite and Palantir; DHS has not confirmed this[15].
Narrative as a weaponThree parties are shaping how this is seen. The Department of Peace and DDoSecrets want readers to see an accountability act aimed at the people running enforcement and surveillance programs[8]. DHS and right-leaning outlets want readers to see doxxing that endangers agents, especially undercover ones[3][13]. Okta wants readers to see a problem on the customer's side, not a failure of its platform[9]. One point is easy to lose under all three framings. Most of the 41,000 people listed are not undercover agents or senior officials. How DHS's own directory was set up is a question no party has answered yet[12].
How Each Side Sees It
Each major actor’s view — how it frames things, its underlying incentive, and how it’s materially affected. Tap a side to read it.
Frames it asTheir strongest case is about safety. An undercover investigator's cover is a working tool, and publishing the name can end an investigation and endanger informants as well as the agent[3]. Officers are civil servants carrying out laws Congress passed. In this view, publishing their names and offices invites harassment of people, not debate about policy[3]. DHS says it will "work to ensure all are properly protected"[3].
WhyTo protect staff and ongoing operations. Also to keep the story focused on the criminal hack, not on how its own login and directory systems let this much data out[3][12].
Impact on themDHS may need to move or reassign exposed undercover staff, review its access controls and answer to congressional oversight[12][9]. SAN describes the leak as covering about one-fifth of the agency's workforce[9].
Frames it asTheir strongest case is about public accountability. They say the people running mass deportation, rendition and surveillance programs use public power and should be identifiable by the public. DDoSecrets co-founder Emma Best said the aim was to replace "anonymity with accountability" and that the release could support journalism, public records requests and congressional oversight[8]. The hackers say DHS employees "have our information, so it's only fair that we have theirs," and that they hope the data can limit further harm by DHS[3]. They frame the leak as a direct reply to Secretary Mullin's escalation pledge[9].
WhyTo raise the personal cost of taking part in immigration enforcement, and to show that DHS systems are weak[9][8].
Impact on themPossible federal criminal investigation of the hackers. DDoSecrets risks renewed legal and political pressure as a publisher of stolen data[1][8].
Frames it asMany of those listed are support, IT or administrative staff with no public role[12]. They argue that putting a clerk's office location next to an undercover agent's name lumps people together without regard to what each one does. They also note that a work address and phone number lead straight to them[4][12].
WhyPersonal and family safety, and the security of their jobs[3][4].
Impact on themExposure to harassment, phishing and identity-based scams. Some may face reassignment[12][7].
Frames it asOkta's position: its platform was not breached[9]. Analysts make a separate point. In single sign-on, one login opens many internal apps, and the customer (here, DHS) decides what each logged-in user can see, including staff directory profiles. So one stolen or misused employee login could pull a large directory without Okta's own systems being hacked[12][7].
WhyOkta wants to protect trust in a product used across government. Analysts want stronger identity controls[9][12].
Impact on themPossible reviews of how federal agencies configure single sign-on directories[12].
Like this article?
The Bias Ledger average rating 3.3
The same story, as framed by outlets across the spectrum, ordered least to most biased. The bias score (1 = straight, 10 = heavily spun) is an AI assessment of that framing — click an outlet to see its track record. The tell is the word choice or omission that reveals the angle.
| Outlet | Vantage | Bias | How they frame it | The tell |
|---|---|---|---|---|
| The Washington Post | U.S. center-left | 2 | ICE, CBP and other DHS officer identities posted online in data breach | Neutral verb ("posted online"). It uses the group's own "hacktivist" label and gives detail on the Okta access claim and the DDoSecrets partners. |
| NPR | U.S. center-left (public broadcaster) | 2 | Hackers expose the identities of more than 40,000 DHS employees | Plain framing. It quotes the hackers' motive line next to DHS's response. |
| BBC | UK public broadcaster | 2 | Details of thousands of US immigration agents leaked in major hack | Focuses on immigration agents and the scale of the hack. It gives a lower ICE count (about 6,600) and quotes Okta's denial. |
| SBS | South Korean commercial broadcaster | 3 | U.S. Government Agency Hit by Another Cyberattack... Personal Info of 40,000 DHS Employees Leaked | "Another cyberattack" frames it as part of a pattern of U.S. government security failures. |
| Fox News | U.S. right | 4 | DHS investigates data breach that may have doxxed 40,000 employees | Uses "doxxed" as the frame and puts its own confirmation of undercover agents up front. It gives the highest ICE count (about 10,000) and gives little detail on the hackers' stated motive. |
| The Epoch Times | U.S. right | 4 | 41,000 Homeland Security Employees and Undercover ICE Agents Exposed in Data Leak, Hackers Say | Puts undercover ICE agents in the headline. It does correctly attribute the claim ("Hackers Say"). |
| Daily Kos | U.S. left (partisan community site) | 6 | Hackers disclose a list of over 41,000 DHS employees including ICE, & CBP | "Disclose a list" softens the leak into a disclosure. The doxxing and safety frame is absent. |
References
- ICE, CBP and other DHS officer identities posted online in data breach — The Washington Post · U.S. center-left mainstream newspaper; owned by Jeff Bezos
- Hackers expose the identities of more than 40,000 DHS employees — NPR · U.S. public broadcaster; center-left audience; funded by listeners, foundations and member stations
- DHS investigates data breach that may have doxxed 40,000 employees — Fox News · U.S. right; owned by Fox Corporation (Murdoch family)
- Over 41,000 U.S. Homeland Security officials' details apparently exposed after massive data breach — CNBC · U.S. business news, center; owned by Versant
- Details of thousands of US immigration agents leaked in major hack — BBC (republished by Yahoo News) · UK public broadcaster funded by the licence fee
- Icepick — Distributed Denial of Secrets · Primary source; transparency/leak-publishing nonprofit and a party to the leak
- Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents — TechCrunch · U.S. tech trade press, center; owned by Yahoo
- Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists — CyberScoop · U.S. cybersecurity trade press, center; owned by Scoop News Group
- Shielded by DHS, immigration agents' identities exposed in massive data breach — Straight Arrow News · U.S. outlet that markets itself as unbiased; owned by Nebraska billionaire Joe Ricketts, a Republican donor
- Hacker collective leaks DHS employee records — The Hill · U.S. political news, center; owned by Nexstar Media
- Personal data of 40,000 U.S. Homeland Security employees leaked in security breach — CBC News · Canadian public broadcaster
- DHS personnel leak exposes contact details and sensitive job information — Nextgov/FCW · U.S. federal-workforce trade press, center; owned by GovExec
- 41,000 Homeland Security Employees and Undercover ICE Agents Exposed in Data Leak, Hackers Say — The Epoch Times · U.S. right; linked to the Falun Gong movement
- Hackers disclose a list of over 41,000 DHS employees including ICE, & CBP — Daily Kos · U.S. left; partisan community blog (user-submitted diary)
- DHS Hack Exposes 41,000 Employees, Including ICE Agents, and Reveals Access to Surveillance Tools — International Business Times Singapore · Commercial digital news aggregator; low editorial transparency
- U.S. Government Agency Hit by Another Cyberattack... Personal Info of 40,000 DHS Employees Leaked — SBS · South Korean commercial broadcaster