Massive breach hits DHS: 41,000 employees, including undercover agents, exposed

A hacktivist group calling itself the Department of Peace has released data identifying over 41,000 US Department of Homeland Security (DHS) employees. A public search tool called “Icepick” reveals internal agency structures and the identities of agents involved in undercover operations, including phone numbers, emails, and workplace addresses.

The stolen internal dataset, containing employee names, offices, contact information, and assignments, was reportedly obtained from an Okta single sign-on service used by the DHS.

The hacktivist group shared the data with Distributed Denial of Secrets (DDoSecrets), a whistleblowing organization, which released the dataset publicly, as well as with “maia arson crimew”, a journalist and hacker, who created the Icepick online search tool.

The leaked data spans 9 agencies, 41,191 people from nearly 7,000 offices, and over 2,200 locations.

"This dataset is massive in terms of both size and impact. It provides an unprecedented look into the DHS’s organizational structure, highlighting which people do what work across multiple DHS agencies, including ICE. It is a complete game changer for anyone investigating DHS, simplifying the identification of agents and their lines of command,” said crimew.

Emma Best, DDoSecrets co-founder, argues that the data could help identify officials responsible for specific policies and operations. The

“It identifies the officials responsible for overseeing covert and undercover operations, the government’s hunt for leakers and the failed BlueLeaks investigation – along with key personnel in DHS's ever-escalating rendition and deportation programs,” Best said.

Hacktivists framed the leak as a response to intensified ICE operations, quoting Homeland Security Secretary Markwayne Mullin.

On July 17th, Markwayne Mullin said he was 'turning up the heat.' This is what happens to ICE when you do that,

a Department of Peace spokesperson said.

What's in the dataset?

The dataset indexes 21,329 CBP employees, 6,598 ICE (Immigration and Customs Enforcement) employees, 6,245 USCIS (US Citizenship and Immigration Services) employees, 3,421 Homeland Security Investigations (HSI) staff, 1,755 DHS headquarters personnel, 980 CISA employees, 394 Federal Protective Service staff, 337 Federal Law Enforcement Training Centers personnel, and 132 Science and Technology Directorate staff.

Each employee includes the following data:

• Full name, Job title
• Agency, component, and department
• Direct manager’s name
• Employment status (employee/associate/contractor)
• Names of employees reporting to the individual
• Workplace address, office identifier
• Email addresses
• Phone number, mobile phone number
• Active Directory/Okta group memberships, potentially revealing organizational affiliations with other teams
• Timestamps of record creation and modification

The public search tool warns that the list is not comprehensive, doesn’t include all DHS employees, and may contain inaccuracies in the source data. The leaked dataset includes at least some of the highest-ranking officials.

The hacktivists excluded CISA (Cybersecurity and Infrastructure Security Agency) from search results ”to prioritize the law enforcement and intelligence arms of the DHS.”

The leak affects about a fifth of DHS employees – according to the DOGE website, the total DHS headcount is 222,538. ICE has 20,254 employees, and 65,268 people work at CBP.

A spokesperson for Homeland Security told TechCrunch that DHS is aware of a potential breach, is working to address the issue, and will update the public when more details are available.