DHS Data Leak: 41,000 Employee Records Exposed | Update

Activist hackers have published personal data on more than 41,000 employees of the U.S. Department of Homeland Security (DHS), marking the third major federal data leak in a month. The dataset, released by the transparency collective Distributed Denial of Secrets (DDoSecrets) on October 28, 2026, includes names, phone numbers, email addresses, job titles, and internal email groups for staff at agencies including Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP).

What is the Department of Homeland Security?

The US Department of Homeland Security was created in the aftermath of the 9/11 attacks to unify national security efforts. It oversees agencies for immigration, aviation security, cybersecurity, and more. Under the Trump administration, ICE gained attention for its aggressive deportation policy and arrests, while agents often operate without uniforms or visible identification, drawing criticism from human rights groups.

What data was exposed in the DHS leak?

The leaked records cover roughly one-seventh of the department's 260,000-strong workforce and were last updated on August 19, 2026. The collection, dubbed 'Icepick,' reveals far more than contact details. It includes office locations, supervisors, job titles, and more than 55,000 permission groups that hint at internal operations.

Breakdown by agency

• Customs and Border Protection (CBP): over 21,000 records
• Immigration and Customs Enforcement (ICE) and Homeland Security Investigations: about 10,000 records
• U.S. Citizenship and Immigration Services (USCIS): roughly 6,200 records
• Cybersecurity and Infrastructure Security Agency (CISA): nearly 1,000 records

Some internal groups reference undercover operations, wiretaps, and surveillance tools such as Penlink and the facial-recognition app Mobile Fortify. WIRED identified 39 Homeland Security Investigations employees linked to 'CUC,' a term associated with certified undercover operations.

How did hackers obtain the data?

The data was attributed to an entity calling itself 'Department of Peace.' It claims to have harvested the information from DHS's Okta single sign-on service, but Okta has denied any compromise. DHS said it is 'aware of a potential breach and is actively working to address the situation.' Reuters verified details for several employees but could not authenticate the entire trove.

This is the third major federal data breach in a month. In September, hacker group ShinyHunters claimed to have FBI files in retaliation for an FBI appeal never to pay extortionists; shortly after, a suspect was arrested in the Netherlands. Later that month, a Pentagon personnel database was reportedly accessed for months, exposing millions of U.S. military records.

Impact and security concerns

DDoSecrets co-founder Emma Best said the goal is to 'replace anonymity with accountability,' arguing that the data enables public oversight and freedom-of-information requests. 'They have our data, so it's only fair we have theirs,' a DDoSecrets spokesperson told NOS. However, critics warn that exposing agents' personal details puts them and their families at risk, as criminals can also access the information. 'Experts in government cybersecurity caution that this kind of exposure facilitates impersonation and targeted attacks,' one analyst noted.

FAQ: DHS data leak explained

How many DHS employees were affected?

More than 41,000 current and former DHS employees and contractors had their records published, about one-seventh of the workforce.

What information was leaked?

Names, work emails, phone numbers, office locations, job titles, supervisors, and internal email groups, plus references to surveillance tools and undercover operations.

Who published the DHS data?

The transparency collective Distributed Denial of Secrets (DDoSecrets) published the dataset, crediting a group called 'Department of Peace.'

Was Okta hacked?

Okta, DHS's identity provider, denies its systems were compromised. DHS says it is investigating the incident.

Is the leaked data accurate?

Reuters verified some employee details but could not authenticate the full trove. DDoSecrets noted the data may be incomplete or partially incorrect.