"Icepick" leak exposes records on 41,000 DHS employees, including undercover ICE agents
US Department of Homeland Security (Okta identity directory)
Distributed Denial of Secrets published "Icepick" on Oct 28 2026, an archive covering more than 41,000 employees and contractors of the US Department of Homeland Security and seven component agencies, including ICE and CBP. The records, last updated Aug 19 2026, include work email addresses, cellphone numbers, office addresses, supervisors and more than 55,000 permission-group names, some referencing undercover operations, wiretap programs and tools such as Palantir and PenLink. DDoSecrets says the data came from DHS's Okta login system via a group calling itself the Department of Peace; Okta says it has no evidence its own systems were compromised.
Why this severity: Identity and contact records for about a seventh of the DHS workforce, including undercover and surveillance-program group memberships; no passwords or financial data reported
- Started
- Oct 28, 2026
Affected
Not published yet
Fixed in
No fixed release yet
Timeline3
Distributed Denial of Secrets publishes "Icepick", records on more than 41,000 DHS employees and contractors (email addresses, phone numbers, office addresses, supervisors and over 55,000 permission-group names, including groups tied to undercover operations and wiretap programs). DDoSecrets says the data came from DHS's Okta login system and was obtained from a group calling itself the Department of Peace.
Okta tells WIRED it is unaware of any breach of its systems and has no evidence its data or systems were compromised. DHS and DOJ did not respond to WIRED's request for comment.
Last update date of the leaked DHS records, which cover DHS itself and seven component agencies including ICE and CBP.
News & write-ups3
Posts2
The leaked records include the locations of ICE and CBP facilities, workers' cellphone numbers, and the members of groups tied to wiretap programs, Palantir software, and xAI’s Grok chatbot. t.co/av5nTBqwAo
‼️ BREAKING: A leak has exposed ~41,000 Homeland Security workers, including undercover ICE agents. Wired found mobile numbers, ICE and CBP sites and groups tied to Palantir and Grok. DDoSecrets says it came via DHS's Okta login. Okta says it has no evidence it was compromised. t.co/fqaan4E5P5
Notes & caveats
How the Department of Peace group got the data has not been confirmed: DDoSecrets says it came from DHS's Okta login system, while Okta says it is unaware of any breach of its systems. DHS has not commented. Per WIRED, CBP staff make up more than half of the records, ICE about 10,000, USCIS about 6,200 and CISA nearly 1,000.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
