Hackers Publish Records of More Than 40,000 DHS Employees, Including Undercover ICE Personnel

A hacker group calling itself the Department of Peace published personnel records for more than 40,000 Department of Homeland Security employees and contractors on Wednesday, Oct. 28. The archive, hosted by the transparency nonprofit Distributed Denial of Secrets (DDoSecrets) under the name "Icepick," covers DHS and seven component agencies.

The records include names, job titles, email addresses, cell phone numbers and office locations. They also include more than 55,000 permission groups that control who can access which internal systems. The data was last updated in August.

What is in the archive

More than 21,000 records belong to Customs and Border Protection employees. Roughly 10,000 more cover Immigration and Customs Enforcement and its Homeland Security Investigations (HSI) unit, and just under 1,000 are tied to the cybersecurity agency CISA. The rest cover headquarters staff and agencies such as U.S. Citizenship and Immigration Services and the Federal Protective Service.

That is about a fifth of a workforce of a little more than 220,000.

The permission groups show who is cleared to use what. Thirty-nine HSI employees across more than a dozen field offices sit in groups labeled "CUC," which federal court filings say stands for "certified undercover operation." One group tied to HSI's St. Paul, Minnesota, area references "Keyhole." Court filings describe Keyhole as a certified undercover operation that funded HSI surveillance of Minneapolis protest groups earlier this year.

More than 200 CBP accounts are linked to a group referencing Mobile Fortify, the face-recognition app immigration agents use. More than 700 accounts, nearly all CBP, appear tied to Signal. Other groups reference Palantir's Falcon platform, PenLink phone-records analysis, wiretap programs and AI chatbots. One group labeled "Grok.com" lists eight DHS technology officials, including the department's former chief information officer and chief data officer.

ICE inside the military commands

The files also map ICE's presence inside the Pentagon's combatant commands. An HSI unit chief appears to oversee the agency's military liaisons. His subordinates include a combatant command program manager at Special Operations Command headquarters in Tampa, an HSI liaison to Africa Command in Stuttgart, Germany, and a senior liaison to Southern Command in Doral, Florida.

All of them are listed as users of Penlink, Falcon and RavenGo. PenLink, according to documents obtained by 404 Media, lets officials track individual cell phones or collect data on everyone in a given location. DHS phased out Falcon in favor of an in-house system, RAVEN.

An HSI contractor listed as a "CENTCOM analyst" works at CBP's National Targeting Center in Sterling, Virginia. That contractor does not have access to ICE's own surveillance software.

The unit chief also belongs to a group called "LCR_Users." The acronym may refer to the Office of the Director of National Intelligence at Liberty Crossing in McLean, Virginia. Two employees list "ODNI" in their titles and Liberty Crossing as their location.

How the data was taken

The hackers say they got in by subverting DHS's single sign-on system, which TechCrunch and others identify as Okta. Okta rejects that. "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised," a company spokesperson told Wired.

DHS has said it is "aware of a potential breach" and is "actively working to address the situation swiftly and effectively." It has not said how the data left its systems. TechCrunch and Reuters each verified portions of the records as authentic.

The hackers attached a note to the archive: "They have our information, so it's only fair that we have theirs." A spokesperson for the group tied the release to Markwayne Mullin's July 17 statement that he was "turning up the heat," saying: "This is what happens to ICE when you do that."

TechCrunch reports the same hacker earlier claimed to have taken thousands of contracts between DHS and private vendors, including defense contractors and surveillance firms. It also follows breaches involving FBI agents' personnel records and Pentagon human-resources data on millions of current and former service members.

Accountability or exposure

The dispute is over what the release is for. Ryan Ottignon, a U.S.-based journalist who worked with the Swiss activist maia arson crimew to build a searchable version, told NPR he rejects the label of doxing. "We are in a situation in which a group of public officials go around into cities and states and all around the country, and they seek to hide who they are. Very frequently using masks, wearing plain clothes," he said.

Emma Best, a DDoSecrets cofounder, called the leak "extraordinary but deceptive in its simplicity." She said it makes explicit connections between officials overseeing covert operations and key personnel in the deportation programs. Other activists told NPR the names and emails will make freedom of information requests far more productive.

DHS sees it differently. After the searchable ICEpick site went up, the department sent a letter to the domain host demanding it "stop serving the personal contact and location data of individuals who did not consent." The site was taken down.

The tension is plain on the facts. The archive includes cell numbers and office addresses for rank-and-file CBP officers at airports and ports of entry, plus people assigned to certified undercover operations. Those are not policy-makers. Whatever one thinks of ICE tactics, exposing the contact and location data of undercover personnel is a physical-safety issue for the officers and for any ongoing investigations.

The government's own record is also a problem. Three major federal personnel breaches in recent months, at the FBI, the Pentagon and now DHS, raise a direct question about whether agencies are protecting the data of people they ask to do dangerous work.

Still unresolved: whether DHS will confirm the scope of the exposure, whether any undercover operations were compromised, and whether Okta or DHS can account for how login records last updated in August ended up on a public leak site.