Full Breakdown
Massive DHS Data Breach Exposes Identities of Tens of Thousands of Employees
By Drooid · · How we work
In this breakdown
01
Core Event: Leak of DHS Personnel Records
A hacktivist collective calling itself the “Department of Peace” released a searchable archive named “Icepick” on a Wednesday via Distributed Denial of Secrets (DDoSecrets). The archive contains names, phone numbers, email addresses, job titles, agency assignments and internal access-group memberships of employees and contractors across multiple components of the U.S. Department of Homeland Security (DHS), including ICE, CBP, USCIS, HSI, CISA and others. The data were reportedly obtained from DHS’s Okta single-sign-on service, though Okta has denied any compromise.
02
Background & Context: Enforcement Surge and Recent Breaches
The leak follows a period of heightened immigration enforcement under Secretary Markwayne Mullin, who on July 17 said ICE would “turn up the heat” on streets. The disclosure arrives amid other recent U.S. government data incidents, such as a September breach claimed by ShinyHunters that targeted FBI personnel and a Defense Department breach affecting millions of service members.
Visual evidence
Images from the story
![DHS said it was working to ensure its employees were properly protected and would update the public 'when more information is available' [FILE: September 19, 2025] Image: Erin Hooley/AP](https://static.dw.com/image/79587070_605.jpg)
03
Data & Statistics: Scope of the Exposed Records
- 41,000+ employees listed in the RT-English report.
- 41,191 individuals identified in the CyberDaily analysis.
- 21,300 CBP records, 6,600 ICE records and 3,400 HSI records detailed in the RT-English description.
- 55,000+ user groups and 6,900+ offices referenced in the CyberDaily count.
The dataset also references surveillance tools such as Palantir’s Falcon, Mobile Fortify facial-recognition software, and AI services like OpenAI’s ChatGPT, Google’s Gemini and xAI’s Grok.
04
Official Statements & Responses
- DDoSecrets co-founder Emma Best said the archive could aid journalists, congressional inquiries and legal challenges by “replacing anonymity with accountability.”
05
Criticism & Opposition
Former acting ICE director John Sandweg warned that the exposure creates a “nightmare scenario” for undercover agents, putting them “in great jeopardy” and endangering ongoing investigations.
06
Conflicting Reports & Gaps
Sources differ on the exact number of affected personnel, ranging from “more than 40,000” to “over 41,000” and a precise figure of 41,191. Some reports list specific agency breakdowns, while others note broader inclusion of CISA and Federal Protective Service staff without detailed counts. Verification remains incomplete; Reuters confirmed phone numbers for six employees but could not authenticate the entire trove.
07
Verbatim Quotes
- “We will update the public when more information is available.” — Distributed Denial of Secrets
- “I feel terrible for the agents and their families,” — John Sandweg, acting ICE director
08
What's Next
DHS has pledged further updates as the investigation proceeds. The agency’s assessment will determine whether additional security measures, such as changes to the Okta authentication system, are required. Advocacy groups and journalists plan to use the searchable tool to examine agent identities, potentially prompting congressional oversight hearings.