CC BY-SA 4.0 Picture by.
A hacktivist group called the “Department of Peace” breached a cloud-based single sign-on / Okta login system of the U.S. Department of Homeland Security (DHS), exposing the personal and operational details of more than 41,000 employees and contractors. The leaked data was published online in a searchable database named “Icepick” via the transparency nonprofit Distributed Denial of Secrets (DDoSecrets) and cybersecurity researcher maia arson crimew.
Key Details of the Breach.
Scale and Scope. The leak impacts roughly 15% to a fifth of the DHS workforce (covering more than 41,000 total personnel records last updated in August 2026).
Affected Agencies.
U.S. Customs and Border Protection (CBP). Over 21,000 records.
Immigration and Customs Enforcement (ICE). Nearly 6,600 to 10,000 records (including personnel within Homeland Security Investigations).
U.S. Citizenship and Immigration Services (USCIS). Around 6,200 records.
Other components. Federal Protective Service, Cybersecurity and Infrastructure Security Agency (CISA), and DHS headquarters.
Exposed Information. The database contains employee names, work email addresses, office locations, work phone numbers, job assignments, supervisory structures, and references to internal tracking systems. It also reportedly identifies officials tied to covert or undercover operations, surveillance programs, and recent enforcement actions.
Hackers’ Motivation. The “Department of Peace” group stated the leak was retaliation following political and enforcement tensions, explicitly pointing to a statement made by DHS/administration officials about “turning up the heat” on ICE.
DHS Response. The Department of Homeland Security acknowledged the breach and launched an investigation, requesting that foreign hosting providers (such as Iceland-based FlokiNET) take down the leaked repository due to physical safety, doxxing, and harassment risks, though the database was subsequently mirrored and republished.
Details of more than 41,000 personnel working for the US Department of Homeland Security (DHS), including thousands involved in immigration enforcement, have been leaked to the public.
The leak includes names, work addresses and phone numbers of DHS staff, including agents working with Immigration and Customs Enforcement (ICE) and Customs and Border Protection, along with descriptions of the work they do for each agency.
Wednesday’s leak marks the third time in recent weeks that a government agency has been targeted by leaks or hacks.
A DHS spokesperson said the agency is “aware of a potential breach and is actively working to address the situation swiftly and effectively.”
“We take all security threats against our employees and officers seriously and will work to ensure all are properly protected,” the spokesperson added.
“We will update the public when more information is available.”
The seemingly unprecedented breach of employee information was made public online. A group called the Department of Peace accessed the information from DHS, while journalist and cybersecurity researcher maia crimew alongside the website Distributed Denial of Secrets put it online.
The information was put in a database named Icepick.
Most of the agents included, more than 21,000 of them, work for CBP, according to the data. Nearly 6,600 work for ICE.
Other records show agents with Homeland Security Investigations, the Federal Protective Service and even people working for the Cybersecurity and Infrastructure Security Agency.
The leaked information also included dozens of previously unknown operation names, the agents that led and worked on those operations, and some of the technology they used in their work, including tech provided by Cellbrite and Palantir