DHS Worker Data Leak Exposes Sensitive Information on 41,000 Employees and Contractors

An unprecedented leak has exposed sensitive information on over 41,000 Department of Homeland Security (DHS) workers and contractors, as well as details on undercover operations and surveillance programs.

The records, which include email addresses, phone numbers, office addresses, and references to internal systems, span DHS itself and seven component agencies, including Immigration and Customs Enforcement (ICE) and US Customs and Border Protection.

According to the leaked data, which was last updated on August 19, 2026, the transparency nonprofit Distributed Denial of Secrets has made available an archive that provides a map of how DHS is organized and operates.

The leak, dubbed "Icepick by DDoSecrets, appears to have originated from DHS's Okta login system, according to a note with the files. The hackers behind the leak wrote, They have our information, so it's only fair that we have theirs.

Okta has denied any breach of its systems, stating that they are secure and there is no evidence of a compromise. An Okta spokesperson told WIRED that the company is aware of the report but has found no reason to believe their data or systems were compromised.

The leaked information raises concerns about the agency's handling of sensitive details on employees and operations. DHS has been under scrutiny for its aggressive pursuit of critics, seeking to unmask anonymous social media users and obtain customer records on protesters.

This move comes as part of a broader trend where DHS and the federal government have sought to hide the identities of public employees, expanding the definition of doxing to include basic facts about government workers.

A massive leak has exposed personal information on 41,000 DHS workers, including undercover ICE agents.

The leaked records are available on a website called crimew, where users can search for and view details about individual employees.

Law enforcement agencies have been dealing with a separate breach involving hackers known as ShinyHunters, who claimed to have stolen data from nearly every FBI employee and their families. Several suspects have been arrested and another is being held in connection with the incident.

The DHS has acknowledged the potential breach and is working to address it quickly and effectively. The agency takes all security threats against its employees seriously and will take steps to ensure they are properly protected.

Details of the leaked records suggest that CBP staffers account for more than half of the exposed personnel, while ICE makes up around 10,000 of the affected individuals. Approximately a third of these ICE workers belong to Homeland Security Investigations, the agency's investigative wing.

The leaked data also reveals information about US Citizenship and Immigration Services employees, with nearly 6,200 records exposed. Additionally, over 1,000 files are linked to the Cybersecurity and Infrastructure Security Agency, more than half of which are associated with contractors.

The leaked records show that most DHS workers have access to internal systems, including permission groups used for controlling access. At HSI, employees across multiple field offices belong to groups related to undercover operations, such as CUC" and "Keyhole.

Further details in the leaked data reference various programs, including a Communications Intercept Center TechOps program, a Title III Intercept Program for wiretaps, and an Illicit Sensor Intercept Program.

The leaked documents reveal further details about various programs and tools used by DHS workers, including those related to immigration court records, phone data extraction, and surveillance.

Among these tools are Palantir's Falcon platform and PenLink, which can analyze phone records and social media activity. These platforms suggest a sophisticated approach to gathering and processing intelligence, likely aimed at enhancing national security efforts.

The leaked documents also mention permission groups that grant exceptions to DHS's web filter, which blocks certain websites for employees. Two such groups, Executive Leadership" and "AI Access, list the same 13 individuals, including several high-ranking officials.

These officials include Kristi Noem, a former head of DHS; Antoine McCord, who recently left his position as chief information officer to return to defense tech company Anduril; Philip Hegseth, a senior adviser to the DHS secretary and brother of Defense Secretary Pete Hegseth; and Jayce Krachenfels, a policy adviser with ties to Donald Trump's 2024 presidential campaign.

The leaked documents also reference AI tools developed by major tech companies, including OpenAI's ChatGPT, Google's Gemini, and Microsoft's Copilot. One group, Grok.com, lists eight DHS technology officials, including the department's former chief information officer and chief data officer.

A national security expert at Recorded Future notes that this dataset could be extremely valuable for adversaries seeking to penetrate DHS, particularly when combined with other compromised information and intelligence collections. This raises concerns about potential vulnerabilities in ongoing investigations and personnel impersonation attempts.

A significant number of CBP personnel have been found to be part of groups referencing Signal, an encrypted messaging app, and Mobile Fortify, a face-recognition app used by immigration agents for identification purposes. Over 700 accounts are associated with these groups, the majority belonging to CBP employees. A substantial proportion of these individuals work in Texas, California, and Arizona.

The data also reveals that nearly 1,300 ICE enforcement accounts have been created since July 4, 2025, when the One Big Beautiful Bill Act was signed into law. This legislation funded the hiring of an additional 10,000 ICE Enforcement and Removal officers by the end of 2025. The rapid expansion of these personnel raises concerns about the impact on existing operations.

The leaked records contain a number of accounts associated with the Department of Defense, which is referred to as the Department of War in some contexts. Approximately 20 such accounts have been identified, including eight that belong to a group titled ICE Tip Line DOW Surge. Furthermore, around 170 accounts are listed as providing military processing support at ICE facilities.

The records also include references to personnel with specific job titles, such as Designated Immigration Officers and 287(g) Officers. These individuals work in local law enforcement and have been authorized to carry out certain immigration enforcement duties. Many of these officers list county sheriff's offices and jails as their workplaces.

In addition, the dataset contains around 4,400 associates, who hold a range of jobs from IT development and data science to nursing and detention officer roles. Of these, approximately 145 are classified as contractors or high-risk contractors.

The records also reveal connections between senior officials at DHS headquarters and lower-ranking personnel. Over 300 references have been found to senior titles associated with the department's central administration, including those related to intelligence, technology, biometrics, and privacy.

The leaked data has revealed a significant number of Homeland Security (DHS) workers and undercover Immigration and Customs Enforcement (ICE) agents, sparking concerns about government transparency and accountability.

Prosecutors have taken action against individuals who post information about individual ICE officers, labeling it as stalking or threats of violence under specific laws. This approach has been criticized by civil liberties advocates, who argue that such actions infringe upon the right to free speech and assembly.

A senior attorney at a nonprofit organization specializing in civil liberties pointed out that the Trump administration's interpretation of 18 USC 119 is overly broad, allowing for prosecution of individuals sharing restricted personal information" about federal officers or their families with the intent to threaten them.

The leaked data contains basic work details and names, which critics argue are not sensitive enough to be considered restricted. They maintain that such information would typically be found on a business card, making it difficult to justify criminalization under this law.

Despite controversy surrounding the leaked data, its creators see it as an accountability tool aimed at exposing the activities of DHS workers who operate in secret, often without transparency or public scrutiny.