Hackers Publish Work Details of 41,000 Homeland Security Employees

What it is

Icepick is a searchable archive that Distributed Denial of Secrets (DDoSecrets) published on 28 October 2026. It indexes 41,191 DHS employees and contractors: 21,329 from Customs and Border Protection and about 10,000 from ICE, a third of those in Homeland Security Investigations. Each record has name, title, office, email, phone number and manager. The archive also lists more than 55,000 internal permission groups. DDoSecrets co-founder Emma Best says it contains no home addresses.

How it works

The group calling itself the Department of Peace says it took the records from an Okta single sign-on service used by DHS and passed them to DDoSecrets. Its stated motive is a response to Secretary Markwayne Mullin's 17 July pledge of stepped-up ICE operations. Okta told Reuters it has "no evidence our data or systems were compromised." The page does not describe how any intrusion was carried out.

Why it matters

Security researchers cited by the page warn that the manager and reporting-line fields could be used to impersonate a supervisor by phone. They also warn it could help identify who sits behind a sensitive investigation. The permission group labels show how DHS access is organised. The page does not say what the labels reveal. Transparency groups see the contact details as useful for public-records requests.

Caveats

• The full archive is unverified. Only a sample of named employees has been matched to other records.
• The newest records date to 19 August 2026, and some entries are stale. CISA staff who have since left the agency still appear.
• DHS says it is aware of a potential breach. It filed a takedown notice through ZeroFox asking the domain registrar to stop serving the data.
• The search site stopped loading on 29 October with a registrar hold on its domain. Bluesky is blocking links to the nonprofit hosting the archive. The page does not say whether copies exist elsewhere.
• The page gives no technical remediation, indicators of compromise or Okta configuration guidance.
• Related context: in September 2026 the ShinyHunters group claimed 2 to 3 terabytes of data on FBI agents and job applicants. The bureau told staff to assume hackers have their personal data.