Hacktivist Group Leaks Personal Data of 41,000 DHS Employees, Exposing ICE and CBP Agents

A hacktivist group calling itself the Department of Peace has published a searchable database containing the personal information of more than 41,000 employees of the U.S. Department of Homeland Security, including thousands of Immigration and Customs Enforcement and Customs and Border Protection agents, in one of the largest known leaks of federal personnel records in recent years.

The dataset, dubbed "Icepick," was posted late Wednesday on Distributed Denial of Secrets, a nonprofit that hosts leaked materials in the public interest. The group claims it obtained the records from an Okta single sign-on system that DHS uses to let employees and contractors across its component agencies log into the department's central network.

The exposed records include names, job titles, office locations, work email addresses and cellphone numbers, and in some cases details which internal systems and applications each employee is authorized to access. The data was first provided to journalist and security researcher maia arson crimew, who passed a copy to DDoSecrets.

More than half of the records -- roughly 21,000 -- belong to CBP employees who work at airports and other ports of entry, according to an analysis of the dataset. 10,000 records are tied to ICE and its Homeland Security Investigations unit, and just under 1,000 relate to staff at the Cybersecurity and Infrastructure Security Agency. The remainder covers DHS headquarters and other components, including U.S. Citizenship and Immigration Services and the Federal Protective Service.

The total is equivalent to roughly one-fifth of DHS's workforce of 220,000. Timestamps on the individual records suggest the directory data was exfiltrated around mid-August, though the breach had not previously been disclosed.

"They have our information, so it's only fair that we have theirs," the Department of Peace said in a note left with the data. The group has framed the leak as retaliation for remarks by DHS Secretary Markwayne Mullin, who said on July 17 that ICE would be "turning up the heat on the streets" by intensifying immigration arrests and traffic stops.

DDoSecrets co-founder Emma Best said the dataset is not a complete roster of the department. "Rather than an indiscriminate directory of every DHS employee, Icepick identifies many of the architects and drivers of DHS policy and operations," she said in a statement quoted by the group.

DHS told the Washington Post it was "aware of a potential breach" and was "working to address the situation swiftly and effectively." The department did not respond to requests for further . Okta said it was aware of the report but denied that its own systems had been compromised. "Okta is secure, and we have no evidence our data or systems were compromised," a spokesperson said.

Beyond identity data, the leak sheds light on the surveillance and cybersecurity tools that DHS personnel can access through internal user groups in the department's Active Directory. Most of the employees in the dataset belonged to a group with access to Microsoft 365, which hosts the agency's email and files, along with groups for Adobe Acrobat, Citrix and other standard desktop software.

Roughly 4,500 users, including ICE agents and deportation officers, are listed as members of a group called "Headspace_users." The online therapy provider held an $82,500 federal contract with ICE that ended in 2023 to fund mental health software for employees of the agency's Enforcement and Removal Operations unit. A Headspace spokesperson said the company has not provided services to DHS or ICE since 2023.

Dozens of other user groups reference Penlink, a surveillance firm whose technology is designed to track the location data of mobile devices and analyze communications. The groups range from a handful of users in local DHS offices to more than 2,000 across ICE's Homeland Security Investigations unit nationally. One group specifically references Penlink PLX, which the company says captures and analyzes real-time intelligence from calls, texts, web activity and social media. Penlink did not respond to a request for .

Another group includes more than 200 CBP users associated with Mobile Fortify, a facial recognition application used by CBP and ICE agents to identify people and verify their immigration status. The user groups also include several employees with access to ChatGPT, among them senior DHS officials, as well as groups tied to investigations of China-backed hacking operations known as Salt Typhoon and Volt Typhoon.

The breach is the latest in a series of intrusions targeting U.S. government personnel records. It follows the theft of thousands of FBI agents' personnel files and the personal information of millions of current and former military service members held by the Pentagon's human resources unit. It is also the second incident linked to DHS this year; the same hacker previously claimed to have taken thousands of contracts between the department and private-sector vendors, including defense contractors and surveillance suppliers.

Transparency advocates said the exposed details could prove valuable to researchers pursuing records requests. "Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results," said Ryan Shapiro, executive director of the nonprofit Property of the People. Best said the dataset would serve as a "catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests."

The leak lands amid heightened scrutiny of DHS enforcement operations. The Migration Policy Institute estimates the department completed 980,000 deportations during the first 18 months of President Donald Trump's second term, as agents have been documented using physical force during operations. DHS has sought to shield the identities of CBP and ICE agents conducting raids around the country while also tracking down online critics.

The incident also raises questions for Okta and other identity-management vendors whose platforms underpin access to sensitive government networks. For investors, the disclosure highlights the persistent risk that third-party authentication systems pose to federal agencies, and the potential for congressional and regulatory scrutiny of how contractors secure identity data. Shares of Okta were not immediately affected in premarket trading, and the company has maintained that its own infrastructure was not breached.

The exact origin of the exposure and whether the vulnerability that allowed it has been remediated remain unclear. Neither DHS nor Okta would say whether an investigation is under way or whether affected employees have been notified.