A hacktivist group has published internal records identifying more than 41,000 Department of Homeland Security employees and contractors, in what security researchers are calling one of the most detailed government workforce exposures in recent memory.
The group, which calls itself the "Department of Peace," shared the data with Distributed Denial of Secrets (DDoSecrets), a nonprofit that publishes leaked government datasets, and with Swiss hacker-journalist maia arson crimew. The records went public on October 29 and cover staff across nine DHS agencies.
The group tied the release directly to DHS Secretary Markwayne Mullin's July 17 comments, in which he told reporters he was "turning up the heat" on immigration enforcement. That remark, the group said, was the trigger.
What the data contains
The leaked dataset holds 41,191 records spanning employees and contractors across nine DHS sub-agencies, pulled from nearly 7,000 offices and more than 2,200 locations. Each record contains names, job titles, supervisor relationships, direct reports, employment status, workplace addresses, email addresses, phone numbers, and internal group memberships.
CBP accounts for the largest share with 21,329 records, followed by ICE at 6,598 and USCIS at 6,245. Homeland Security Investigations holds 3,421 records, DHS headquarters 1,755, and CISA 980. The Federal Protective Service, FLETC, and the Science and Technology Directorate account for the remainder. Combined, the exposed records represent roughly one-fifth of DHS's reported headcount of 222,538, according to the DOGE website. CISA records were pulled from the public-facing search results but remain in the underlying dataset.
The Icepick tool
Crimew, who faces a U.S. federal indictment tied to prior leaks, built a searchable interface called "Icepick" and hosted it at icepi.cx. The domain registrar pulled the site down shortly after launch. DDoSecrets responded by releasing the tool's source code publicly. By Thursday morning, the searchable site was offline, but the data itself continued to circulate.
DDoSecrets co-founder Emma Best said the dataset extends well beyond contact information. The records, she wrote, identify officials overseeing covert and undercover operations, the government's internal effort to track down leakers, and the now-defunct BlueLeaks investigation. Crimew described it as "a complete game changer for anyone investigating DHS" and said it "provides FOIA material for years to come."
Ryan Shapiro of Property of the People, a government transparency organization, offered a narrower read, noting that staff contact information could prove useful for Freedom of Information Act requests.
Okta in the spotlight
The Department of Peace claimed the data came from an Okta single sign-on service used internally at DHS. Okta said it reviewed the report and found no evidence that its systems or data had been affected.
That denial has not fully closed the question. CyberScoop verified that numerous active CISA employees appear in the dataset alongside former agency leaders who left government years ago. The records also reference internal groups tied to COVID-19 planning and a 2023 internal summit, suggesting the data spans multiple years and may reflect sustained access rather than a single point-in-time pull.
Bluesky moved to block links pointing to the leaked data and flagged them as malicious, according to WIRED. The speed with which journalists and researchers confirmed active employees in the dataset drew particular concern, given that portions of the records appear to touch on undercover personnel.
A pattern of DHS breaches
This is not the first substantial data exposure tied to DHS. In 2014, a breach potentially affected as many as 390,000 current and former employees, applicants, and contractors. In 2018, the department notified nearly 250,000 people after another incident. Earlier this year, security firm GitGuardian found a publicly accessible GitHub repository containing credentials for privileged AWS GovCloud accounts and internal CISA systems, with the exposure dating back to at least November 2025.
Last month, the hacking group ShinyHunters published a separate spreadsheet containing records on roughly 5,000 alleged FBI employees, including home addresses and emergency contacts, framing that release as retaliation for an FBI advisory about the group.
DHS confirmed it is investigating the current incident. "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively," as mentioned by a spokesperson, adding that the department would release further details as they became available. DHS did not respond to additional requests for comment by publication time.
Read the original article:
Hacktivists Dump Records of 41,000 DHS Employees, Citing ICE Escalation