Leak Exposes 41,000 Homeland Security Workers–Including Undercover ICE Agents

What it is

Icepick is an archive of records on more than 41,000 DHS employees and contractors, published by Distributed Denial of Secrets (DDoSecrets) in 2026. The records were last updated on August 19, 2026. DDoSecrets says the data comes from DHS's Okta login system. The researcher crimew built a searchable site for it. A group calling itself the Department of Peace supplied the data, and its note reads "They have our information, so it's only fair that we have theirs."

What the records contain

Each record has an email address, phone number and office address. Most also name a supervisor, so reporting lines across the department can be rebuilt. More than 300 records carry headquarters titles, including officials who oversee intelligence, technology, biometrics and privacy.

The archive also holds more than 55,000 permission groups, which show what systems people can reach. WIRED's analysis found:

• HSI undercover: 39 employees in more than a dozen field offices are in groups with "CUC" in the name. Court filings say this stands for "certified undercover operation". One St. Paul-area group references "Keyhole", an operation that funded undercover surveillance of Minneapolis protest groups.
• Intercept programs: groups reference CICTO, a Title III wiretap program and ISIP.
• Tools: groups reference Palantir Falcon and PenLink. More than 700 accounts, nearly all CBP, are in a Signal group. More than 200 CBP accounts are in a Mobile Fortify group, about half of them in Texas, California and Arizona.
• AI access: groups reference ChatGPT, Gemini, Copilot and Grok.com. "Executive Leadership" and "AI Access" appear to list the same 13 people given web-filter exceptions.
• Account mix: about 4,400 "associates", 145 of them marked "contractor" or "high risk contractor". There are roughly 1,300 ICE enforcement accounts created since July 4, 2025, and about 170 listed as military processing support.

Risk assessment

Alexander Leslie of Recorded Future says that, if authentic and current, the dataset is "an extraordinarily valuable intelligence resource for those seeking to penetrate DHS". Leslie says its value rises when correlated with previously compromised and commercial data. Leslie names targeting of vulnerable personnel, convincing impersonation and compromise of ongoing investigations as the uses.

Caveats

• Okta says it has no evidence its data or systems were compromised. The page does not say how the data was obtained.
• DHS, DOJ and the FBI gave no comment on authenticity. Leslie's assessment is conditional on the data being authentic and current.
• The page gives no indicators of compromise, remediation steps or guidance for defenders.
• The creators say Icepick is an accountability tool, not doxing. Attorney Adam Steinbaugh of FIRE says basic work details are "information that would be on a business card". The administration has prosecuted people for posting details about ICE officers.