A hacktivist group says it breached a Department of Homeland Security single sign-on service and exposed information on more than 41,000 employees, including personnel at Immigration and Customs Enforcement and Customs and Border Protection, as well as government cybersecurity workers.
The data was published in a searchable repository called Icepick on the Distributed Denial of Secrets website. The group, which calls itself the Department of Peace, reportedly obtained the information through an Okta service used by DHS. Copies of the database were also shared with Swiss investigative journalist and cybersecurity researcher maia arson crimew, who built a tool to search it.
The exposed records reportedly include names, contact details, job assignments, office addresses and phone numbers, along with information about internal systems. The archive also revealed a list of applications connected to the employee login dashboard, including surveillance software such as Penlink and AI tools such as ChatGPT and Gemini. The data’s contents have raised questions about what information federal agencies may enter into commercial AI services.
The group framed the breach as retaliation for government surveillance and immigration enforcement. It referred to DHS Secretary Markwayne Mullin’s July remarks about “turning up the heat on the streets” and said, “This is what happens to ICE when you do that.” A note distributed with the files added: “They have our information, so it’s only fair that we have theirs.”
A DHS spokesperson told CNET that the department was aware of a potential breach and was working to address it. The spokesperson said the agency takes threats against employees and officers seriously and would work to ensure they were protected.
DHS has sought to remove websites hosting the information, including Icepick’s searchable archive. Bluesky blocked links to DDoSecrets, citing its rules against unauthorized sharing of personal information and other material that could create safety risks.
Although the reported 41,000 employees are a portion of the nearly quarter-million people at DHS, the breadth of the information may create risks for staff and operations. Cross-referencing the records could expose undercover work, while the data may also include personnel with no direct role in enforcement, such as airport security workers. DDoSecrets cofounder Emma Best said the archive was not simply a directory of all department employees, but identified people involved in shaping DHS policy and operations.
Sources: CNET.