Icepick Leak Reveals Personal Data of Tens of Thousands of Homeland Security Employees

In a breach disclosed by the hacker group “Department of Peace,” a database dubbed Icepick containing personal information for more than 40,000 U.S. Department of Homeland Security (DHS) employees was published on October 28. The dataset includes names, job titles, work email addresses, cell phone numbers, and office locations for staff across Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), the Cybersecurity and Infrastructure Security Agency (CISA), and other DHS components.

TechCrunchDHS Orders FlokiNET To Remove Icepick Leak Exposing ICE And CBP Staff Data: 18 outlets compared

• Approximately 21,000 records pertain to CBP agents who operate at airports and ports of entry.

TechCrunch

• Roughly 6,600 entries belong to ICE personnel, with an additional 10,000 linked to ICE’s Homeland Security Investigations (HSI) unit.

TechCrunch

• Just under 1,000 records involve CISA staff.

TechCrunch

• The remaining entries cover employees at DHS headquarters, U.S. Citizenship and Immigration Services, the Federal Protective Service, and other agencies, amounting to about one-fifth of DHS’s total workforce of roughly 220,000.

TechCrunch

The leak also reveals internal user-group memberships within DHS’s Active Directory, showing widespread access to Microsoft 365, Adobe Acrobat, Citrix, and other standard software. Notably, about 4,500 users—including ICE agents—are members of a “Headspace_users” group tied to a former federal contract with the mental-health provider Headspace. Additional groups reference contracts with surveillance firms Penlink and Mobile Fortify, the latter providing facial-recognition tools used by CBP and ICE.

TechCrunch

• DHS sent a formal request to Icelandic hosting provider FlokiNET, demanding the removal of the live site that hosted the Icepick database, citing risk of harassment and physical harm to over 40,000 identifiable individuals.

DHS Orders FlokiNET To Remove Icepick Leak Exposing ICE And CBP Staff Data: 18 outlets compared

• An Okta spokesperson stated, “Okta is secure, and we have no evidence our data or systems were compromised.” (see Quote q1).

DHS Orders FlokiNET To Remove Icepick Leak Exposing ICE And CBP Staff Data: 18 outlets compared

• DHS officials have not publicly commented on the breach, and a DHS spokesperson did not respond to media inquiries.

TechCrunch

Transparency advocates argue that the exposed contact information could aid Freedom of Information Act (FOIA) requests and investigations into alleged government abuses. Ryan Shapiro, executive director of the nonprofit Property of the People, emphasized that “Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results” (Quote q3). He added that “Given the Trump administration’s contempt for even basic transparency, the need for such tools is urgent” (Quote q4).

TechCrunch

• “Okta is secure, and we have no evidence our data or systems were compromised.” — Al Jazeera Okta, while an Okta spokeswoman

DHS Orders FlokiNET To Remove Icepick Leak Exposing ICE And CBP Staff Data: 18 outlets compared

• “They have our information, so it’s only fair that we have theirs,” — Department

TechCrunch

• “Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results,” — Ryan Shapiro, the executive director of transparency nonprofit Property of the People

TechCrunch

• “Given the Trump administration’s contempt for even basic transparency, the need for such tools is urgent,” — Shapiro. DDoSecrets

TechCrunch