Massive DHS Personnel Leak Exposes Over 40,000 Employees

On October 28, the nonprofit transparency collective Distributed Denial of Secrets (DDoSecrets) published personal data for more than 40,000 Department of Homeland Security (DHS) employees. The “Icepick” dataset includes names, job titles, email addresses, phone numbers, office locations and internal user-group memberships across agencies such as Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), the Cybersecurity and Infrastructure Security Agency (CISA) and U.S. Citizenship and Immigration Services (USCIS).

The VergeTechCrunchThe HillHacker Behind "Department of Peace" Posts 40,000 DHS Employee Records Online: how 11 outlets framed it UsNews and World ReportCyberscoop

The breach follows recent government exposures, including a September FBI hack and a Pentagon HR breach. The hacker group “Department of Peace” says the data were harvested from DHS’s Okta single-sign-on system.

TechCrunch

• ? 40,000 employee records released.

TechCrunch

• ? 21,000 entries relate to CBP staff.

TechCrunch

• ? 10,000 entries belong to ICE and HSI personnel.

The Verge

• ? 1,000 entries involve CISA employees.

TechCrunch

• The leak represents roughly one-fifth of DHS’s workforce of about 220,000.

The Hill

• Over 4,500 users belong to a group named “Headspace_users,” linking ICE deportation officers to a former contract with the mental-health app provider Headspace.

TechCrunch

• User groups also reference contracts with surveillance firms Penlink and Mobile Fortify, and access to Microsoft 365 and Adobe Acrobat.

TechCrunch

• Emma Best, co-founder of DDoSecrets, said the release “replaces anonymity with accountability.”

Hacker Behind "Department of Peace" Posts 40,000 DHS Employee Records Online: how 11 outlets framed it

• The Department of Peace left a note with the data stating, “They have our information, so it’s only fair that we have theirs.”

UsNews and World Report

• DHS did not return requests for comment.

UsNews and World Report

• Reuters matched personal details for six employees to credit-bureau and dark-web breach data, confirming accuracy for those records.

UsNews and World Report

Critics note the leak’s potential to expose private-sector contracts supporting immigration enforcement. Ryan Shapiro, executive director of the transparency nonprofit Property of the People, warned that the Trump administration’s “contempt for even basic transparency” makes the released contact information urgently needed for accountability.

TechCrunch

• Authenticity: TechCrunch described the dataset as “appears authentic,” while Reuters expressed uncertainty about the full collection’s provenance.

UsNews and World Report

• Vulnerability Status: The breach appears to have occurred around mid-August, but it is unclear whether the Okta vulnerability has been patched or whether DHS is aware of the theft.

Cyberscoop

• Scope of Non-Employee Data: The leak includes historical entries dating back to 2023, yet the completeness of older records cannot be confirmed.

UsNews and World Report

• “Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results,” — Ryan Shapiro, executive director of Property of the People

TechCrunch

These statements underscore the perceived value of the data for FOIA research and the ethical rationale presented by the leakers.

UsNews and World Report