A group calling itself the Department of Peace has leaked internal records identifying more than 41,000 Department of Homeland Security employees and contractors, including immigration officers and, according to WIRED, Fox News and The Washington Post, some undercover investigators. Distributed Denial of Secrets, a nonprofit that publishes leaked and hacked files, published them on Wednesday, October 28, as a searchable archive it calls "Icepick." The Washington Post said it verified the records with current and former DHS officials, and several other news organizations confirmed parts of them. DHS says it is "aware of a potential breach" but has not said how the data left its systems. The hackers say they took it through an Okta single sign-on service, a one-login system the department uses to give staff access to its applications; Okta says it has no evidence that its own systems were compromised.
The publishers say the archive identifies the officials behind DHS's deportation and covert programs and will help journalists, congressional investigators and people filing public-records requests. John Sandweg, a former acting director of Immigration and Customs Enforcement, called the release a "nightmare scenario" that puts officers "in great jeopardy." Sarah Pierce, director of social policy at the Third Way think tank and a former official at U.S. Citizenship and Immigration Services, told CNN that many of those listed "have served the federal government for decades, under multiple administrations" and "didn't design these policies." An unnamed U.S. official familiar with the leak called it "embarrassing" but added, "we have certainly seen worse," CNN reported; officials who spoke to CNN also said they were concerned the data could be used for phishing and doxxing. This article does not name anyone listed in the records or link to them.
What the records contain
According to an analysis by WIRED, the records cover DHS itself and seven component agencies and were last updated on August 19, 2026. They list names, work email addresses, phone numbers, office addresses, supervisors and membership in internal permission groups, which control access to department systems. Some group names appear to reference particular tools and programs: WIRED found more than 200 Customs and Border Protection accounts in a group referencing Mobile Fortify, a face-recognition app immigration agents use to identify people, and other groups referencing a wiretap program. Customs and Border Protection accounts for more than half of the entries. WIRED counted about 10,000 tied to ICE, roughly a third of them in its investigative arm, Homeland Security Investigations; Reuters and the BBC counted about 6,600 ICE employees. A CNN review found records for at least three ICE and Border Patrol officers involved in shootings during the second Trump administration.
WIRED found 39 Homeland Security Investigations employees in groups whose names include "CUC," which government court filings say stands for "certified undercover operation." Fox News said it independently confirmed that the records include the names of several undercover ICE agents. The publishers have cautioned that the archive is not a complete roster and may contain errors, and some entries belong to people who have left the department.
Who has checked it, and how it was taken
No outlet has verified every record. Reuters matched personal details of about six employees to credit bureau records and breach data, and confirmed the details of three others by phone. CyberScoop verified that numerous current employees of the Cybersecurity and Infrastructure Security Agency are listed. TechCrunch matched names against an offline copy and reported that timestamps suggest the records were taken around mid-August.
The account of how they were taken comes only from the hackers and their publishers. Okta's statement, "Okta is secure, and we have no evidence our data or systems were compromised," addresses its own systems; neither Okta nor DHS has said how the records left the department or whether whatever allowed it has been fixed. CNN reported that DHS is investigating the hackers' claims itself; Thomas Warrick, a former DHS deputy assistant secretary for counterterrorism policy, called for a thorough congressional investigation of how the breach happened: "DHS can't just lock the barn door after the horse was stolen," he told CNN. The same group claimed in March to have hacked DHS, and Distributed Denial of Secrets then published data on the department's contracts with more than 6,000 companies.
Accountability or exposure
The group tied the leak to DHS Secretary Markwayne Mullin. "On July 17th, Markwayne Mullin said he was 'turning up the heat.' This is what happens to ICE when you do that," a spokesperson said. At a July 17 press conference, after a dispute with the White House over ICE traffic stops, Mullin had said: "We're turning up the heat on the streets." A note left with the files said, "They have our information, so it's only fair that we have theirs." Emma Best, a cofounder of Distributed Denial of Secrets, said Icepick "identifies many of the architects and drivers of DHS policy and operations" rather than offering "an indiscriminate directory"; WIRED's own analysis describes the files as running "from senior leadership down to individual immigration agents and detention contractors." Best's statement in the release says that "by replacing the regime's anonymity with accountability," the archive and its search tool are a "catalyst for investigations," and maia arson crimew, the Swiss hacker and journalist who built the tool, said in the same release that it simplifies "the identification of agents and their lines of command."
The U.S. government has described both publishers in other terms. In 2020, after Distributed Denial of Secrets published hacked police files known as BlueLeaks, a DHS intelligence bulletin called the group "a criminal hacker group," and German authorities seized its server at the request of U.S. authorities; Best said then that the group has "no involvement in actual hacks." A federal grand jury in Seattle indicted crimew in 2021 on charges tied to hacks of companies and government agencies, which the Justice Department said are only allegations. She told Straight Arrow News she was not involved in hacking DHS and only built the searchable database.
Sandweg said identifying officers could also jeopardize investigations into gangs and drug cartels. "I feel terrible for the agents and their families," he told the Post. Officers have faced criticism for wearing masks and working in plain clothes; DHS officials have defended the practice, saying personnel and their families have faced assaults, stalking and death threats. ICE and other agencies have long withheld comprehensive employee lists, citing national security, while advocacy groups argue that secrecy can impede accountability for alleged misconduct, according to Newsmax's account of the Post's reporting.
"Email addresses and phone numbers are indispensable tools for FOIA researchers," said Ryan Shapiro of the transparency group Property of the People. "If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS," Alexander Leslie of the threat-intelligence company Recorded Future told WIRED. He said an adversary could use it to "identify vulnerable personnel, develop convincing impersonation attempts, or compromise ongoing investigations." Adam Steinbaugh of the civil-liberties group FIRE said of the names and basic work details: "This is information that would be on a business card. That's not something the government can criminalize." The administration takes a different view: WIRED reported that it has prosecuted protesters for posting information about individual ICE officers, and that DHS has widened its definition of "doxing" to include publishing public employees' names and titles. In the case WIRED cites, 15 Minnesota residents were charged in June under laws related to stalking and threats of violence, which prosecutors linked to their participation in ICE-opposition activities. Steinbaugh says the administration has taken an expansive view of 18 U.S.C. § 119, a federal law that protects certain personal details of federal officers and their families, among them a mobile phone number; WIRED says the records include workers' cell phone numbers. The law makes it a crime to make such details publicly available only "with the intent to threaten, intimidate, or incite the commission of a crime of violence" against the officer or a family member, or "with the intent and knowledge" that they "will be used to threaten, intimidate, or facilitate the commission of a crime of violence."
The government's response
"DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively," a department spokesperson said. "We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available." White House border czar Tom Homan told reporters on Thursday that the breach could put officers at greater risk and that the Justice Department is investigating, The Washington Post reported. "I want the American people to know that ICE agents are mothers and fathers, too. They have families, too," Homan said at a news conference in Miami. A former ICE official told the Post, on condition of anonymity, that the intelligence unit of Homeland Security Investigations had warned agents about the breach. Several ICE officers and Customs and Border Protection agents in Tucson, Philadelphia and East Texas told the Post, which reached them through the leaked records, that no one had told them. DHS told its workforce in a memo on Thursday, reviewed by CNN, that it was "working to understand the scope of the situation, assess potential threats, and identify appropriate resources and protective measures." Searches through Thursday afternoon found no public statement from Mullin himself or from the unions that represent ICE officers and Border Patrol agents.
The department has also moved to get the search site taken down. ZeroFox, a security company with authority to seek removal of online data on the department's behalf, asked the Icelandic hosting company FlokiNET on Thursday to take the site down, saying it "places more than 40,000 identifiable individuals at risk" of harassment, stalking and physical harm, according to the request as quoted by The Guardian and Al Jazeera. ZeroFox wrote that its request "rests on two facts: the data was stolen, and it is personal data that identifies and locates real people," CyberScoop reported. FlokiNET refused, saying the site publishes "work identities of government employees," not private details, and that the public has "a legitimate interest in knowing who is doing that work, under whose authority, and in which office." TechCrunch saw a separate ZeroFox notice asking the site's domain registrar to "stop serving the personal contact and location data of individuals who did not consent to its publication"; the registrar put the domain on hold Thursday morning and did not answer TechCrunch's request for comment. The search site was back online at a different address later that day, CyberScoop and The Guardian reported.
This article reflects reporting through the evening of Thursday, October 29, 2026. Sources: WIRED, October 28; CyberScoop; The Washington Post, October 28 (via Newsmax) and October 29; Reuters, via The Guardian; TechCrunch, October 28, and March 2; Nextgov/FCW; Fox News; BBC; Washington Examiner, July 17; CNN, The Guardian, CyberScoop and Al Jazeera, October 29; TechCrunch, October 29 (not linked: it links the search site); on the publishers' records, The Verge, August 13, 2020, the Justice Department's March 18, 2021 release and Straight Arrow News, October 29; 18 U.S.C. § 119.
