Hacktivists Leaked 41,000 DHS Workers Including Undercover ICE Agents, and Okta Says It Wasn't Breached

The Department of Homeland Security has been treating the publication of its agents' names as doxing. Now its own org chart is public. Records on more than 41,000 DHS employees and contractors, including people in undercover operations, landed online on Wednesday.

Transparency nonprofit Distributed Denial of Secrets published the archive, which it calls "Icepick." It came from a group calling itself the Department of Peace and was shared with Swiss hacker and journalist maia arson crimew, who built a searchable website. By Thursday morning that site had been taken offline.

A map, not a list

The files cover DHS and seven component agencies including ICE and CBP, about a seventh of the department's workforce, with records last updated Aug. 19. They hold email addresses, phone numbers including cell numbers, office addresses, facility locations and supervisors, enough to reconstruct who reports to whom. They also list membership in more than 55,000 permission groups.

Those groups are the revealing part. Wired's analysis found CBP makes up more than half the records, ICE about 10,000, roughly a third of them in Homeland Security Investigations. Thirty-nine HSI employees across more than a dozen field offices belong to groups tagged "CUC," which court filings say means certified undercover operation.

Other groups reference a Title III wiretap program, a Communications Intercept Center, Palantir's Falcon platform and PenLink phone analysis. More than 700 accounts, nearly all CBP, sit in a group referencing Signal, and more than 200 CBP accounts in one referencing Mobile Fortify face recognition. A "Grok.com" group includes eight DHS technology officials. Roughly 1,300 ICE enforcement accounts have been created since July 4, 2025.

The Okta question

"They have our information, so it's only fair that we have theirs," the hackers wrote alongside the files. A Department of Peace spokesperson told CyberScoop the breach answers DHS Secretary Markwayne Mullin's July 17 pledge to turn up the heat on ICE operations, and said the database came from an Okta single sign-on service used at DHS.

Okta rejects that. "Okta is secure, and we have no evidence our data or systems were compromised," the company said. DHS told Wired it is "aware of a potential breach" and working to address it.

Alexander Leslie of Recorded Future called the archive, if authentic and current, "an extraordinarily valuable intelligence resource for those seeking to penetrate DHS." He said an adversary could spend months mining the relationships to find vulnerable personnel, craft impersonation attempts or compromise investigations.

A department that hides its names

The leak lands in the middle of a fight over exposure. DHS and the administration have moved to hide employees' names and faces and stretched "doxing" to cover basic facts like names and titles. In June, 15 Minnesota residents were charged under stalking and threat laws linked to ICE opposition. FIRE attorney Adam Steinbaugh has described names and work details as information "that would be on a business card."

Federal personnel data keeps leaking. ShinyHunters claimed to have stolen data on nearly every FBI employee, and one of its alleged members was detained in Jordan. DHS itself was breached in 2014, affecting up to 390,000 people, and in 2018, when nearly 250,000 were notified.

Some offers on this page may be paid placements or contain affiliate links.