Shielded by DHS, immigration agents’ identities exposed in massive data breach

A group of hackers on Wednesday did what the Department of Homeland Security (DHS) has steadfastly refused to do: expose the identities of thousands of federal immigration agents.

The hackers breached a DHS internal database that lists the names, telephone numbers, email addresses and job assignments of employees from Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP) and other branches of the department. Many of the agents have been involved in highly contentious enforcement and deportation activities during the second Trump administration — including operations that led to the deaths of two U.S. citizens in Minneapolis and several other controversial shootings.

Download the Straight Arrow app today to get the stories that matter free from manipulation, bias or agenda.™

Point phone camera here

DHS has refused to identify officers, even after they were involved in violent episodes, and agents routinely keep their names secret and wear face masks in public. Although some have been publicly outed through crowdsourcing , the release of the hacked data represents the broadest exposure of the government employees who have carried out President Donald Trump’s aggressive campaign against illegal immigration.

Straight Arrow obtained the data from the Swiss hacker maia arson crimew, who is best known for locating an exposed copy of the U.S. government’s terrorism no-fly list , and the nonprofit leak archiver Distributed Denial of Secrets , known as DDoSecrets. A group calling itself the Department of Peace, or DoP, claimed responsibility for stealing the data from the DHS.

Straight Arrow sought from DHS, ICE and CBP, but none immediately responded. DHS officials have defended keeping agents’ identities secret by saying threats against the agency’s employees have multiplied since immigration enforcement intensified after Trump returned to the White House in 2025.

The hackers accessed the dataset, which they dubbed “ Icepick ,” after obtaining an Okta single sign-on service used by DHS. Okta, an identity and access management company based in San Francisco, allows federal employees to sign in once to access multiple work-approved apps without logging in to each one separately.

”This dataset is massive in terms of both size and impact,” crimew said in a statement. “It provides an unprecedented look into the Department of Homeland Security’s organizational structure, highlighting which people do what work across multiple DHS agencies, including ICE.”

The dataset contains information on almost 42,000 DHS employees, or one-fifth of the agency’s workforce — including some who work in undercover operations.

In addition to ICE and the border patrol, the exposed employees work for Homeland Security Investigations, the Cybersecurity and Infrastructure Security Agency, the U.S. Citizenship and Immigration Services, the Federal Protective Service, the Federal Law Enforcement Training Centers and the Science and Technology Directorate.

‘Architects and drivers’ of policy

DDoSecrets opted to release the dataset to the public alongside a tool developed by the hackers. The tool, according to the nonprofit, is intended to make searching “easier for reporters, activists, legal advocates and others interested in the dataset.”

Journalist and DDoSecrets co-founder Emma Best described Icepick as much more than “an indiscriminate directory” of DHS employees. Instead, she said, the dataset identifies “many of the architects and drivers of DHS policy” as well as “officials responsible for overseeing covert and undercover operations” and the “ever-escalating rendition and deportation programs.”

An online tool, known as icepi.cx , was built by crimew in an effort to further encourage and streamline investigations, including by the public. The tool allows users to for DHS employees based on their names, agencies, job titles and locations.

”It is a complete game changer for anyone investigating DHS, simplifying the identification of agents and their lines of command,” said crimew, who was indicted but never convicted of hacking charges in the U.S. in 2021. “It provides FOIA material for years to come!”

The data lists the names of user groups, to which DHS administrators can add individual employees based on their roles. User group names include Undercover Operations, Covert Operations and Special Operations to Counter Intelligence. The names of law enforcement operations are also listed.

The tool highlights employees deemed high interest to the public, including those involved in well-publicized shootings. Using the online tool, Straight Arrow located information on Jesus Ochoa and Raymundo Gutierrez, the two CBP agents who fatally shot protester Alex Pretti in Minneapolis in January. However, a returned no results for Jonathan Ross, the agent who reportedly shot another protester, Renee Good, to death.

”By replacing the regime’s anonymity with accountability, Icepick and the tool developed by maia are catalyst for investigations, empowering journalists, congressional inquiries, legal challenges, community action and Freedom of Information Act requests,” Best added.

It is not clear when the hack took place. But a spokesperson for the hackers cited made by DHS Secretary Markwayne Mullin.

”On July 17th, Markwayne Mullin said he was ’turning up the heat,’” the spokesperson said, referring to the secretary’s promise to intensify its crackdown following several controversial shootings. “This is what happens to ICE when you do that.”

Round out your reading

A Detroit newspaper breaks long-standing news tradition in US Senate race, citing Rogers’ ‘ repeated lies .’

Virginia senator’s case is two different stories, depending on who’s telling it .

‘Why would you think that me?’: El-Sayed questions his questioners.

Your kids are consuming AI slop . Your parents may be, too.

A social media post accuses James Talarico of sexual abuse. Researchers say it’s Russian disinformation .