In a significant cybersecurity incident that has drawn attention from government agencies and privacy advocates alike, over 41,000 records belonging to Department of Homeland Security personnel have been publicly exposed. The data breach, which occurred sometime before late October 2026, represents one of the largest leaks of federal employee information in recent years.

The leaked database, named Icepick by the publishing organization Distributed Denial of Secrets, contains extensive personal and professional details about workers across multiple DHS components. More than half of the affected individuals work for Customs and Border Protection, with approximately 21,000 records from that agency alone. Immigration and Customs Enforcement accounts for roughly 10,000 personnel files, while U.S. Citizenship and Immigration Services contributes around 6,200 records. Nearly 1,000 entries belong to the Cybersecurity and Infrastructure Security Agency.

What makes this breach particularly concerning is not just the volume of data but its sensitivity. Beyond standard contact information such as email addresses, phone numbers, and office locations, the leak includes names of undercover operations, surveillance program details, and internal system access permissions. Some of the exposed operation names include CUC, referring to certified undercover operations, and Keyhole. The database also references over 55,000 permission groups that link personnel to specific internal systems and tools.

Technology platforms used by these agencies appear prominently in the leaked data. References include Palantir's Falcon platform, Cellbrite forensic tools, Mobile Fortify face-recognition applications, and various artificial intelligence systems like ChatGPT, Gemini, Copilot, and Grok. Wiretap program details are also visible, including Communications Intercept Center TechOps and Title III Intercept Program specifications.

The hacktivist group claiming responsibility identified itself as the Department of Peace. In their statement accompanying the release, they cited comments made by DHS Secretary Markwayne Mullin during a July 17 press conference as motivation. During that event, Mullin stated the agency was turning up the heat on the streets regarding accountability for agents who violated use-of-force policies. This followed fatal shootings involving two individuals, Joan Sebastian Duran Guerrero from Maine and Lorenzo Salgado Araujo from Houston, neither of whom were subject to ICE enforcement activities at the time.

Regarding how the data was obtained, the perpetrators indicated it came through DHS's Okta single sign-on service. This authentication platform allows users to access multiple systems with a single set of credentials. However, Okta has publicly denied any compromise of their own infrastructure. A spokesperson told Wired that there is no evidence their data or systems were breached, suggesting the vulnerability may lie elsewhere within the DHS network architecture.

The decision to publish the records was made by Distributed Denial of Secrets, a transparency nonprofit, along with Swiss cybersecurity researcher Maia Crimew. They created a searchable online database using the information provided by the Department of Peace. Emma Best, founder of DDoSecrets, noted that the records contain connections between officials overseeing covert operations and key personnel involved in deportation programs.

Homeland Security officials responded quickly upon learning of the breach. A spokesperson stated the agency is aware of a potential security incident and is working to address it swiftly. They emphasized taking all threats against employees seriously and promised to update the public as more information becomes available. The agency added they will ensure all affected personnel are properly protected.

This incident marks what appears to be the third government agency targeted by similar leaks in recent weeks, following patterns established by previous breaches like BlueLeaks in 2020. The exposure of undercover operation names and surveillance technology details raises serious questions about operational security within federal law enforcement agencies.

The timing of the leak, occurring after high-profile incidents involving use-of-force controversies, suggests coordinated efforts by activists seeking to expose perceived abuses within immigration enforcement structures. Whether the data represents a complete inventory of DHS personnel or only a subset remains unclear, though it does represent approximately one-seventh of the agency's total workforce.

As investigations continue, the implications for ongoing operations and personnel safety remain uncertain. Law enforcement communities typically rely heavily on operational secrecy, making the public exposure of undercover identities and methods particularly damaging. The situation underscores growing tensions between transparency advocates and national security concerns in an era where digital vulnerabilities can rapidly escalate into major security crises.