Hackers publish 41,000 DHS employee records, exposing undercover agents and surveillance programs

A leak published this week exposes the personal details of more than 41,000 employees and contractors at the US Department of Homeland Security, including undercover Immigration and Customs Enforcement (ICE) personnel. The archive — dubbed "Icepick" and released by the transparency nonprofit Distributed Denial of Secrets — contains email addresses, phone numbers, office locations and job titles, along with an unusually detailed map of how the department and its internal systems are organised, according to WIRED, which previewed the data.

What the data covers

WIRED reports that the records span DHS and seven component agencies and were last updated on August 19, 2026. Customs and Border Protection (CBP) staff make up the largest share — more than half of the records by WIRED's analysis, or around 21,000 records according to TechCrunch figures cited by The Verge. The outlets disagree on the ICE portion: WIRED counts roughly 10,000 ICE records, about a third of them inside Homeland Security Investigations, while The Verge, again citing TechCrunch, puts the figure at just under 7,000. A further 6,200 records belong to US Citizenship and Immigration Services, and close to 1,000 to the Cybersecurity and Infrastructure Security Agency, more than half of them contractors. All told, WIRED estimates the files cover about a seventh of the DHS workforce, from senior leadership down to individual agents, plus some 4,400 "associates" ranging from developers and data scientists to nurses and detention officers.

The records also reflect the department's recent expansion: roughly 1,300 ICE enforcement accounts were created after July 4, 2025, when legislation funded 10,000 new Enforcement and Removal officers, and dozens of accounts belong to local officers deputised for immigration duties, many listing county sheriff's offices as their workplace.

How the leak surfaced

DDoSecrets says the data comes from DHS's Okta login system, and the archive was previewed to WIRED by the nonprofit and by researcher maia arson crimew, who also built a searchable website for the records. Both say they received the files from a group calling itself the Department of Peace, which included a note with the data: "They have our information, so it's only fair that we have theirs." Okta tells WIRED it has no evidence that its own systems or data were compromised. DHS and the Department of Justice did not respond to WIRED's request for comment, and The Verge reports that DHS did not reply to its inquiry either.

Undercover operations and surveillance tooling

The most sensitive material lies in the names of the permission groups. According to WIRED's analysis, 39 Homeland Security Investigations employees across more than a dozen field offices belong to groups whose names include "CUC", an abbreviation that government court filings say stands for certified undercover operation. Another group, apparently based in HSI's St. Paul area of operations, references "Keyhole", which court filings describe as an undercover operation that funded surveillance of Minneapolis protest groups earlier this year. Further groups point to a Title III wiretap intercept program, a Communications Intercept Center TechOps program and an "Illicit Sensor Intercept Program".

Across more than 55,000 group names, WIRED identified references to tools including Palantir's Falcon investigative platform, the phone-records analysis service PenLink, and Mobile Fortify, a face recognition app used by immigration agents — the group tied to that app includes more than 200 CBP accounts, about half of them in Texas, California and Arizona. More than 700 accounts, nearly all CBP, belong to a group apparently referencing the encrypted messaging app Signal.

DHS's own AI usage

The dataset also documents AI tooling inside the department. A group named "Grok.com" lists eight DHS technology officials, including the former chief information officer and former chief data officer, while other group names reference OpenAI's ChatGPT, Google's Gemini and Microsoft's Copilot. Two groups — "Executive Leadership" and "AI Access" — contain the same 13 people, who appear to hold exceptions to DHS's web filtering. WIRED names them as including former DHS head Kristi Noem, recently departed chief information officer Antoine McCord (now back at defense tech firm Anduril), senior advisor Philip Hegseth — the younger brother of the defense secretary — and policy adviser Jayce Krachenfels.

Why it matters

Because most records name a supervisor, the archive lets anyone reconstruct reporting relationships across the department. Alexander Leslie, a national security expert at threat intelligence firm Recorded Future, told WIRED that if authentic and current, the data would be an extraordinarily valuable resource for anyone trying to penetrate DHS, and could be combined with previously stolen or commercial data to target vulnerable personnel, craft impersonation attempts or compromise investigations. The timing sharpens the stakes: the leak follows a breach in which the ShinyHunters group claimed personal information on nearly every FBI employee, and it lands as DHS has moved to unmask anonymous critics and broaden the definition of "doxing" to cover publishing basic facts about public employees — even as the administration has prosecuted people for posting information about individual ICE officers. crimew's stated reason for making the data searchable was blunt: "I don't think we should let them scare us into not looking into them." The incident is also a wider warning that identity and access metadata — who exists, who reports to whom, and who can use which tool — is itself a high-value target.