DDoSecrets Publishes Data on More Than 40,000 DHS Employees, Including ICE and CBP Staff

The nonprofit leak site Distributed Denial of Secrets (DDoSecrets) published an archive on Wednesday, Oct. 28, containing records on more than 40,000 Department of Homeland Security employees and contractors. The release, which it calls "Icepick," includes names, job titles, work email addresses, phone numbers and office locations.

The count varies by tally: 41,000 in one analysis, nearly 42,000 in another. Either way, that is roughly a fifth of a department with about 220,000 employees.

What the data contains

Customs and Border Protection (CBP) accounts for more than half the records, about 21,000. Immigration and Customs Enforcement (ICE) has roughly 10,000, about a third of them in Homeland Security Investigations. U.S. Citizenship and Immigration Services accounts for about 6,200, and the cybersecurity agency CISA for just under 1,000. Headquarters staff and the Federal Protective Service make up the rest.

Job titles and email groups show which employees work in special operations, surveillance, computer forensics and undercover assignments. Timestamps show the records were last updated Aug. 19, 2026, more than two months before publication.

The archive also lists Active Directory group memberships, which govern access to internal tools. About 4,500 users, including ICE agents and deportation staff, belong to a group called Headspaceusers. Other groups are tied to Penlink products, Mobile Fortify and ChatGPT. Those entries may show who has access to a service, not who actually uses it.

How it was obtained

A hacker group calling itself Department of Peace says it pulled the data from the Okta single sign-on system DHS uses to log employees and contractors into its network. The group left a note with the files: "They have our information, so it's only fair that we have theirs." It said it hopes the data "can be used to limit further harm by the DHS."

Okta denies a breach. "Okta is secure, and we have no evidence our data or systems were compromised," a spokesperson said. The Okta claim comes from the hackers and DDoSecrets, and the company has not been shown to have been the point of entry.

The same group claimed in March to have hacked DHS and posted documents on contracts with outside vendors, including defense contractors and surveillance vendors.

On authenticity, Reuters matched personal details for six named DHS employees to credit bureau records and dark-web breach data. It also called three employees directly and confirmed their phone numbers and other details. TechCrunch verified a portion of the data as well.

The accountability argument

DDoSecrets co-founder Emma Best said a search tool built by the hacktivist and journalist known as "maia arson crimew" would "replace anonymity with accountability." Best said it would help journalists, guide public records requests and strengthen congressional oversight. Crimew told WIRED: "I don't think we should let them scare us into not looking into them."

The dataset is public and searchable. It covers staff across enforcement agencies that have drawn heavy criticism from immigration-enforcement opponents, and the hacker group frames the release as retaliation.

The safety argument

DHS has defended keeping agents' identities secret. Department officials say threats against employees have multiplied since immigration enforcement intensified after President Donald Trump returned to office in 2025. Agents routinely wear masks in public, and the department has moved to shield employee names and faces.

WIRED reports that DHS has also broadened its definition of "doxing" to cover publication of basic facts about public employees, such as names and titles. This leak puts that definition to its test at scale, with phone numbers and email addresses attached to people in undercover and surveillance work.

DHS did not immediately respond to requests for comment from Reuters, WIRED or TechCrunch. DOJ also did not respond to WIRED.

A pattern of federal breaches

The leak follows a September claim by the hacking group ShinyHunters to have stolen data on nearly every FBI employee and their families, including job details and medical information. Law enforcement has since arrested several suspects and detained another alleged to be part of that group. Last week, the Defense Department was hit with a class action lawsuit after a breach exposed data on millions of current and former military personnel.

That is three major government data losses in roughly a month, at agencies with national security and law enforcement missions. This DHS breach had not been publicly disclosed before the archive went up.

DHS has not said whether it has confirmed the breach, how the data left its systems, or whether the vulnerability has been fixed. Okta's denial and the hackers' account of an Okta-based theft point in different directions, and only DHS or a forensic review can settle which is right.