loading
loading
An unprecedented leak of Department of Homeland Security records has exposed details of more than 41,000 employees or contractors who work for the department and its constituent agencies. The records include email addresses, phone numbers, and office addresses, but also references to internal systems and sensitive information on undercover and surveillance programs. In all, the leak provides a map of how DHS is organized and how it operates. The records, which span DHS itself as well as seven component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection, were last updated on August 19, 2026. The transparency nonprofit Distributed Denial of Secrets and cybersecurity researcher and journalist maia arson crimew previewed the data for WIRED, which they say they obtained from a group calling itself the Department of Peace. DDoSecrets published the archive, which it calls “Icepick,” on Wednesday. In a press release, DDoSecrets says the data is from DHS's Okta login system. In a note with the files, the hackers wrote, “They have our information, so it’s only fair that we have theirs.” An Okta spokesperson tells WIRED that it is unaware of any breach of its systems. “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised,” the spokesperson says. The leak comes as DHS has aggressively pursued its critics, seeking to unmask anonymous social media users, obtain customer records on protesters, and secure warrants for surveillance tools aimed at reporters. Since the start of the second Trump administration, DHS and the federal government have moved to hide DHS employees’ names and faces. The agency has also expanded its definition of “doxing”—a term that typically refers to publishing someone’s home address and other personal details for malicious purposes—to encompass the publication of basic facts about public employees, like their names and titles. The leak follows a breach in which a group of hackers known as ShinyHunters claimed to have stolen personal information on nearly every FBI employee and their families. Law enforcement agencies have arrested several suspects and detained another who is alleged to be part of the group. The DHS records are searchable on a website crimew built. “I don't think we should let them scare us into not looking into them,” she tells WIRED. The DHS and DOJ did not respond to WIRED’s request for comment. The FBI referred WIRED’s inquiry to DHS. According to a WIRED analysis of the data, CBP staffers account for more than half of the records. ICE accounts for about 10,000, roughly a third of them in Homeland Security Investigations, ICE’s investigative wing. Another 6,200 belong to US Citizenship and Immigration Services, and nearly 1,000 are tied to the Cybersecurity and Infrastructure Security Agency, more than half of them contractors. Altogether, the files cover about a seventh of DHS’s workforce, revealing how DHS is structured, from senior leadership down to individual immigration agents and detention contractors. Like most large organizations, DHS uses permission groups to control access to internal systems, according to the leaked records. Nearly everyone named in the leak has access to at least some of these systems. At HSI, 39 employees across more than a dozen field offices belong to groups whose names include “CUC,” which government court filings say stands for “certified undercover operation.” Another group, apparently based in HSI's St. Paul, Minnesota, area of operations, references "Keyhole," which federal court filings describe as a certified undercover operation that recently funded HSI’s undercover surveillance of Minneapolis protest groups earlier this year. Others reference a “Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program” for wiretaps, and an “Illicit Sensor Intercept Program (ISIP).” The names of the groups—there are over 55,000 in all—appear to reference tools for accessing immigration court records, pulling data from seized phones, and conducting surveillance. These include Palantir’s Falcon investigative platform and PenLink, which analyzes phone records and social media. Two permission groups, named “Executive Leadership” and “AI Access,” appear to list people given exceptions to DHS's web filter, which blocks some websites for employees. They contain the same 13 people, including former DHS head Kristi Noem; Antoine McCord, the recently departed DHS chief information officer who has returned to defense tech company Anduril; Philip Hegseth, listed as a senior adviser to the DHS secretary and the younger brother of defense secretary Pete Hegseth; and Jayce Krachenfels, listed as a policy adviser, who previously worked as a regional field director for Donald Trump’s 2024 presidential campaign, according to his LinkedIn profile. Noem, McCord, Hegseth, and Krachenfels did not respond to a request for comment Other groups named in the leak reference AI tools, including OpenAI’s ChatGPT, Google’s Gemini, and Microsoft’s Copilot. One, called “Grok.com,” includes eight DHS technology officials, including the department’s former chief information officer and chief data officer. “If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS,” says Alexander Leslie, a national security expert at the threat intelligence company Recorded Future. “This dataset becomes way more valuable when correlated with previously compromised information, commercial data, and other intelligence collections. An adversary could spend months exploiting these relationships to identify vulnerable personnel, develop convincing impersonation attempts, or compromise ongoing investigations.” More than 700 accounts are associated with a group apparently referencing Signal, the encrypted messaging app, nearly all belonging to CBP personnel. More than 200 CBP accounts belong to a group referencing Mobile Fortify, a face-recognition app that immigration agents use to identify people. The group includes field supervisors, special response team operators, and tactical and intelligence agents. About half are in Texas, California, and Arizona. Roughly 1,300 ICE enforcement accounts have been created since July 4, 2025, when Trump signed the One Big Beautiful Bill Act, which funded the hiring of 10,000 new ICE Enforcement and Removal officers by the end of 2025. Nearly 20 accounts appear to belong to personnel with the Department of Defense, which the administration styles as the Department of War; eight are in a group titled “ICE Tip Line DOW Surge.” About 170 accounts are listed as providing “military processing support” at ICE facilities, and 35 others explicitly identify National Guard members. Dozens of accounts have job titles like “Designated Immigration Officer” and “287(g) Officer,” which mark local law enforcement personnel authorized to carry out some immigration enforcement duties. Many list county sheriff's offices and jails as their workplaces. The records also include roughly 4,400 “associates,” whose jobs range from IT developers and data scientists to nurses and detention officers. Of those, 145 are named as a “contractor” or “high risk contractor.” More than 300 records reference senior titles associated with DHS headquarters, from Noem down through deputy undersecretaries, assistant secretaries, and chiefs of staff to officials overseeing intelligence, technology, biometrics, and privacy. Most records also name a supervisor, which could allow anyone analyzing the dataset to reconstruct reporting relationships across the department. The Trump administration has prosecuted protesters for posting information about individual ICE officers and warned others for doing so. In June, 15 Minnesota residents were charged under laws related to stalking and threats of violence, which prosecutors linked to their participation in ICE-opposition activities. More than 100 HSI agents, including undercover operatives, took part in an operation that included widespread surveillance and infiltration of group chats. Adam Steinbaugh, a senior attorney at the nonprofit civil liberties group FIRE, says that the Trump administration has taken an expansive view of 18 USC 119, a law that prohibits people from sharing “restricted personal information” about federal officers or their families with the intent to threaten them. “This is information that would be on a business card,” says Steinbaugh of the names and basic work details included in the archive. “That’s not something the government can criminalize." Despite the potential sensitivity of other records in the leaked data, the creators of Icepick do not consider it doxing. They see it as an accountability tool. “The DHS especially as an agency completely lacks accountability, despite many parts of it being incredibly unpopular. The people who work there know this too; for example, some of their LinkedIn bios simply say ‘stuff at US Government,’” says crimew. “If they weren't hiding their involvement in the repressive arm of the US government, there would be no need for us to expose them in the first place.”
document fetched 2026-10-29 02:32