> ## Content Index
> Fetch the complete content index at: https://www.skimwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Leak exposes 41,000 Homeland Security workers, including access groups tied to undercover work
- URL: https://www.skimwire.com/dhs-icepick-leak-41000-employees-okta/
- Published: 2026-10-29T12:48:55.000Z
- Updated: 2026-10-29T12:52:12.000Z
- Description: DDoSecrets says the staff records came from DHS's Okta login. DHS is addressing a potential breach; Okta says it has no sign of compromise.
- Author: Jeremy Moon
- Tags: Security

## The skim

- A hacktivist group calling itself the Department of Peace says it took records on more than 41,000 Homeland Security employees and contractors. The nonprofit Distributed Denial of Secrets (DDoSecrets) published them Wednesday as "Icepick."
- The records include names, job titles, work emails, phone numbers and office locations for staff at ICE, CBP, USCIS, CISA and other agencies. They also show which staff belong to access groups tied to undercover work and surveillance tools.
- DHS says it "is aware of a potential breach." DDoSecrets says the data came from DHS's Okta login system. Okta says it has no evidence its systems were compromised.

## What leaked

[Wired](https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/?ref=skimwire.com), which saw the data before it was published, says it covers DHS headquarters and seven component agencies, with records last updated on Aug. 19, 2026\. By Wired's count, CBP staff make up more than half of the records. ICE accounts for about 10,000, roughly a third of them in its investigative arm, Homeland Security Investigations. USCIS has about 6,200 and CISA nearly 1,000\. That is only part of DHS. Wired puts it at about a seventh of the workforce, and [NPR](https://www.npr.org/2026/10/28/nx-s1-6021497/dhs-hack-ice?ref=skimwire.com) says about a fifth.

The data goes beyond a staff directory. DHS uses permission groups to control access to internal systems, and the leak includes more than 55,000 of them. According to Wired, some group names reference certified undercover operations, while others point to tools such as the Mobile Fortify face-recognition app, Palantir's Falcon investigative platform and PenLink, which analyzes phone records and social media. Most records also name a supervisor, which would let anyone map reporting lines across the department.

In an online post, the hackers said they got in by subverting DHS's single sign-on system, NPR reports. DDoSecrets says the data came from DHS's Okta login system. "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised," an Okta spokesperson told Wired. A DHS spokesperson said the department "is aware of a potential breach and is actively working to address the situation swiftly and effectively."

## Why it matters

For security teams, this is about identity. A single login system is where an attacker would look for a full map of who works where and what they can reach. "If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS," Alexander Leslie of Recorded Future told Wired. He warned that adversaries could combine it with older breach data to target staff with convincing impersonation attempts. The leak follows a recent breach of FBI employee data, The Verge notes.

It's also a political fight. DHS has worked to keep the identities of ICE and CBP officers private, and the administration has prosecuted people for posting details about individual officers. The leakers frame Icepick as accountability. "They have our information, so it's only fair that we have theirs," they wrote in a note with the files, according to Wired. Civil liberties lawyer Adam Steinbaugh of FIRE told Wired that names and basic work details are "information that would be on a business card."

## What's next

DHS has not confirmed how the data was taken or whether it is current, and the FBI referred questions to DHS. DHS says it will update the public when it has more information. People named in the files should be alert for targeted phishing and impersonation attempts. Skimwire is not linking to the dataset.

*Sources:* [*Wired*](https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/?ref=skimwire.com)*,* [*NPR*](https://www.npr.org/2026/10/28/nx-s1-6021497/dhs-hack-ice?ref=skimwire.com) *and* [*The Verge*](https://www.theverge.com/tech/1021528/ice-cbp-data-leak?ref=skimwire.com)*.*