A significant breach has occurred involving the personal information of over 41,000 employees and contractors of the Department of Homeland Security (DHS). The leaked records, which surfaced on October 28, include crucial contact information, job assignments, and details linked to undercover operations, notably within Immigration and Customs Enforcement (ICE).
Details of the Data Breach
The records, last updated on August 19, 2026, were made public by the group Distributed Denial of Secrets under the project name Icepick. This compilation, credited to a group known as the Department of Peace, has been indexed by researcher Maia Arson Crimew to aid public access and journalistic inquiry. The leaked data encompasses names, email addresses, phone numbers, office locations, job titles, and supervisors’ identities across DHS and its seven major branches, including Customs and Border Protection (CBP) and the Cybersecurity and Infrastructure Security Agency (CISA).
CBP employees constitute the majority of the leaked records, with approximately 10,000 linked to ICE, 6,200 to US Citizenship and Immigration Services, and nearly 1,000 to CISA. This information represents about one-seventh of the entire DHS workforce.
Sensitive Information and Potential Threats
The breach also includes over 55,000 permission groups, which manage access to internal systems. Among these are 39 Homeland Security Investigations employees identified within groups marked with “CUC,” connected to certified undercover operations. Other group names suggest involvement with wiretaps and surveillance methodologies.
Initial reports suggest the breach may have originated from an Okta single sign-on system utilized by DHS. However, this claim remains unverified by Reuters, and Okta insists its systems remain uncompromised. This distinction is critical, as a breach of a user identity service does not equate to a compromise of the identity provider itself.
Verification and Implications
Reuters could not validate the entire dataset but corroborated select details by contacting three DHS employees. The exposed information, especially when combined with supervisor names and job responsibilities, could assist malicious entities in crafting targeted impersonation or phishing schemes. Expert Alexander Leslie from Recorded Future emphasized the risks of such detailed disclosures.
This incident follows a similar claim by ShinyHunters regarding FBI personnel data and a lawsuit concerning a Defense Department breach. These occurrences highlight a growing trend in cyber threats, underscoring the need for enhanced security measures.
As cyberattacks become more sophisticated with advances in artificial intelligence, organizations must ensure their defenses are capable of responding swiftly and effectively.
