Hackers publish data on more than 40,000 DHS employees

The hackers posted personal information for more than 40,000 Department of Homeland Security staff online, and timestamp analysis suggests thousands of employee directory records were likely exfiltrated around mid-August, TechCrunch reported.

Straight Arrow put the dataset at almost 42,000 employees, about one-fifth of the workforce, while TechCrunch estimated the same proportion against roughly 220,000 staff. Some 21,000 of the records, more than half of the dataset, involve U.S. Customs and Border Protection employees. Another 10,000 cover Immigration and Customs Enforcement and its Homeland Security Investigations unit. The Cybersecurity and Infrastructure Security Agency accounts for just under 1,000 records, with thousands more tied to DHS headquarters, U.S. Citizenship and Immigration Services and the Federal Protective Service.

The exposed information covers names, job titles, e-mail addresses, mobile phone numbers and work locations for senior officials, cybersecurity staffers and border and immigration agents. The Okta system additionally stores IT and sign-in records that show which systems and internal applications each employee may use. Most workers in the dataset belonged to groups granting access to Microsoft 365, Adobe Acrobat, Citrix and other desktop software, and the data lists membership in the department’s Active Directory, which manages employee accounts and access.

The data also reveals user group names including Undercover Operations, Covert Operations and Special Operations to Counterintelligence, Straight Arrow reported. DHS administrators can assign individual employees to these groups based on role, and the leak also identifies names of law enforcement operations. A search feature highlights workers seen as high public interest, including people tied to well-publicized shootings.

Dozens of user groups mention Penlink, a web surveillance company that claims its technology can track the location data of hundreds of millions of mobile devices, TechCrunch said. The company has held an ICE contract for years, with group sizes running from a handful in local offices to more than 2,000 in Homeland Security Investigations across the country. One group names Penlink PLX, which the company describes as capturing and analyzing intelligence in real time from phone calls, texts, web activity and social media. A separate group ties more than 200 CBP workers to Mobile Fortify, a facial-recognition app used by CBP and ICE agents.

A spokesperson for Penlink did not respond to a request for comment.

Workers with ChatGPT access, including senior DHS officials, appear in user groups too, and additional groups concern investigations into the China-backed Salt Typhoon and Volt Typhoon, TechCrunch added. The Headspace_users group lists about 4,500 users, including ICE agents and deportation officers. Headspace once held an $82,500 federal contract with ICE that ended in 2023 to pay for mental health software for ERO employees. A Headspace spokesperson said the company has not provided services to DHS or ICE since 2023.

The hacker group Department of Peace said it took the data from an Okta single sign-on system used by Homeland Security, Straight Arrow and TechCrunch reported. The hackers named the dataset Icepick. Straight Arrow said it received the data from Swiss hacker maia arson crimew and the nonprofit leak archive Distributed Denial of Secrets, also called DDoSecrets, which released the dataset publicly alongside a search tool created by the hackers. The tool makes searching easier for reporters, activists and legal advocates, among others, and a separate online search tool called icepi.cx, built by crimew, lets users look up DHS workers by names, agencies, job titles and locations.

TechCrunch verified some of the data as authentic by matching names of known Homeland Security workers against an offline copy. The timing of the hack remains unclear, Straight Arrow reported, and it remains unknown whether anyone has fixed the flaw that allowed the breach or whether Homeland Security is aware of the theft, TechCrunch said. TechCrunch said a Homeland Security spokesperson did not immediately respond to its request for comment, and Straight Arrow said it asked DHS, ICE and CBP for comment but received no immediate response. Okta said it knew of the report and described its systems as secure, with no evidence anyone compromised its data.

DHS officials said threats against agency staff have risen since immigration enforcement expanded after Trump took office at the White House in 2025, Straight Arrow reported. Workers who implemented President Donald Trump’s aggressive campaign against illegal immigration face the widest exposure from the hacked data’s release. Straight Arrow reported that agents took part in contentious enforcement and deportation operations under the second Trump administration, including actions that caused the deaths of two U.S. citizens in Minneapolis. DHS has declined to identify officers even after violent incidents, while agents regularly hide their identities and wear face masks in public.

Researchers and public information advocates say the exposed data could provide useful leads for investigations into alleged abuses by the Trump administration, TechCrunch reported. The incident marks the second Homeland Security breach this year, following a separate report from the same hacker that it obtained thousands of contracts between the department and private firms. Previous breaches also took thousands of FBI agents’ personnel files and personal information on millions of current and former military personnel from the Pentagon’s human resources office.

A proposed class action lawsuit filed in Maine state courts accuses DHS agents of driving past the homes of protesters and observers to intimidate them, Gizmodo reported. A DHS spokesperson told Wired that the claim lacks merit and that the lawsuit rests on the incorrect notion that DHS operates a domestic terrorist database. DHS agents assembled dossiers on people monitoring ICE operations and kept them in the Palantir-built Investigative Case Management system, which Homeland Security Investigations uses to manage case files. The system has drawn nearly $126 million in government funding to operate and expand since 2022 alone, including $30 million for developing ImmigrationOS.

Gizmodo reported that immigration authorities shot at least 21 people during Trump’s second term. The American Civil Liberties Union says at least 57 people have died in ICE custody since Trump’s second inauguration, and ICE has sometimes held U.S. citizens in its facilities, Gizmodo reported.