DHS Data Leak Exposes 41,000 Workers, Including ICE Agents

Hackers have exposed records associated with more than 41,000 employees and contractors of the US Department of Homeland Security (DHS), including thousands working for Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP).

The data, published online on Oct. 28, includes employee contact information, job assignments, and details about access to government applications. A group calling itself the Department of Peace claims responsibility for obtaining the records. DHS is investigating a potential breach, while the attackers' method of accessing the information remains unconfirmed.

DHS leak reveals employee identities and sensitive assignments

The leaked information includes names, email addresses, phone numbers, office locations, and job titles across multiple DHS agencies.

According to the BBC, the dataset includes more than 21,000 CBP personnel and nearly 6,600 ICE employees. Other records cover ICE’s Homeland Security Investigations unit, the Federal Protective Service, and the Cybersecurity and Infrastructure Security Agency (CISA).

The records also identify employees assigned to surveillance, human intelligence, computer forensics, special operations, and undercover work.

Reuters independently matched information about six DHS employees against other records and confirmed details with three employees by phone. However, the news agency could not verify the authenticity of the entire dataset.

The nonprofit Distributed Denial of Secrets (DDoSecrets) published the archive, called Icepick. Cybersecurity researcher and journalist maia arson crimew developed a searchable interface for the records.

Hackers claim DHS data came from Okta sign-on service

The Department of Peace claims it obtained the records through an Okta single sign-on service used by DHS employees and contractors to access internal systems.

The alleged access method remains unverified. Reuters could not independently corroborate the claim, and Okta said it had found no evidence that its own systems or data were compromised.

"Okta is secure, and we have no evidence our data or systems were compromised," the company told Reuters.

Meanwhile, TechCrunch reported that timestamps in the employee records suggest the data may have been extracted around mid-August. The initial intrusion date and whether the underlying security issue has been addressed remain unknown.

DHS acknowledged a potential breach but has not publicly confirmed how the records were accessed.

Exposed access groups reveal more than employee contact details

Beyond identifying DHS personnel, the dataset reportedly includes Active Directory group memberships that indicate which internal applications and third-party services employees may be authorized to use.

TechCrunch found references to Microsoft 365, Citrix, surveillance provider Penlink, and Mobile Fortify, a facial-recognition application used by immigration authorities.

Some entries also referenced investigations involving the China-linked hacking groups Salt Typhoon and Volt Typhoon.

Attackers could use the leaked employee records and application access details to identify high-value targets, impersonate colleagues, or send convincing phishing emails to DHS personnel.

The listed group memberships do not, by themselves, establish current permissions, actual application use, or compromise of the referenced systems.

Security teams should review identity access and employee exposure

The DHS incident highlights how employee directories and access-management records can expose organizational relationships even when passwords are not publicly disclosed.

For organizations managing sensitive personnel information, several measures can help reduce comparable risks:

• Audit identity activity: Review authentication logs, unusual account access, unexpected directory exports, and changes to application permissions.
• Limit unnecessary directory access: Ensure employees and contractors can view only the personnel and system-access information required for their roles.
• Warn potentially affected personnel: Prepare employees for targeted phishing, impersonation attempts, and suspicious requests referencing internal assignments.
• Review application group memberships: Identify excessive permissions and remove access that is no longer required.
• Assess operational exposure: Determine whether disclosed organizational information could affect confidential investigations or the safety of employees.

DHS told Reuters it was working to address the potential breach and protect affected personnel.

The department has not publicly confirmed a root cause or detailed remediation measures. The recommendations above address potential exposure risks; they are not findings about how the DHS records were obtained.

For security teams, the practical question is what someone could infer by combining the exposed information. A name and work email provide a contact point. Adding an assignment or application group could give an impersonator a more credible reason to approach that person.

An exposure assessment should therefore identify personnel whose responsibilities and business access could make them valuable targets. Warnings should explain the likely pretexts: requests that reference a colleague, internal tool, or sensitive assignment. Employees should verify unexpected requests through independently obtained contact details, particularly before sharing information or approving access.

Teams should also compare exposed group memberships with current access records. Removing obsolete permissions can reduce access risk, but it does not erase the organizational information already disclosed. Follow-up monitoring should consider both suspicious authentication activity and reports of impersonation, rather than treating an access review as the end of the response.

Read more: The Pentagon breach affecting more than 3 million people shows how exposed personal information and military job details can create lasting identity and personnel-targeting risks.