A hacktivist group has obtained and published records concerning more than 41,000 employees and contractors of the US Department of Homeland Security, exposing parts of the department's internal organization as well as information associated with investigative and surveillance systems.
The archive, named Icepick, was published on Wednesday by Distributed Denial of Secrets, or DDoSecrets, after being supplied by a group calling itself the Department of Peace.
The Washington Post and WIRED, which reviewed the material, reported that the dataset includes names, government and work contact information, job titles, supervisors, offices and internal access groups belonging to personnel across several DHS agencies. The Washington Post said it independently matched information in the database with current and former officials, although the publishers acknowledge that the collection is incomplete and may contain errors.
DHS told media that it was aware of a potential breach and was investigating.
The largest portion of the archive concerns US Customs and Border Protection, with roughly 21,300 records. Around 6,600 entries are associated with Immigration and Customs Enforcement, while approximately 3,400 relate to Homeland Security Investigations, ICE's investigative arm.
Records connected to US Citizenship and Immigration Services, the Cybersecurity and Infrastructure Security Agency and other parts of DHS are also included.
The significance of the leak extends beyond the personnel information itself. More than 55,000 internal group names reportedly appear in the data, providing a partial picture of how employees are organized and which systems or programs some accounts are authorized to access.
WIRED reported that some of those groups are associated with undercover investigations, wiretapping and immigration enforcement databases. Others contain references to software used by DHS personnel, including Palantir's Falcon platform and Mobile Fortify, a facial-recognition application.
Internal groups also contain references to commercial artificial-intelligence services including ChatGPT, Google's Gemini and xAI's Grok. Their appearance in an access group does not by itself establish what the systems were used for, what information was processed through them or the extent of any DHS deployment.
Some records could also help identify personnel involved in undercover work. That has raised concerns about the potential exposure of investigators and ongoing operations. The Washington Post reported that current and former officials warned the disclosure could put personnel at risk and interfere with investigations.
The Department of Peace says it acquired the information through an Okta single sign-on environment used by DHS.
That account has not been independently confirmed.
Okta rejected suggestions that its own infrastructure had been breached, telling WIRED that it had found no evidence that the company's systems or data were compromised. That does not necessarily establish how the DHS information was accessed: an attacker could potentially obtain information associated with an organization's Okta environment without compromising Okta's underlying infrastructure itself.
DHS has so far described the incident as a potential breach rather than publicly confirming the hackers' explanation of how access was gained.
The Department of Peace presented the disclosure as retaliation against US immigration enforcement and government collection of personal information. DDoSecrets and people involved in making the database searchable have argued that the material could be used by journalists and researchers to examine DHS operations and chains of command.
US officials and former DHS personnel have taken a different position, warning that releasing contact details and information capable of identifying undercover personnel creates security risks for employees and their families and could compromise active investigations.
The database offers an unusually detailed look at DHS's organizational structure and the systems to which some personnel appear to have access. It does not, however, establish that every individual listed actively uses the software associated with a particular group, nor does the presence of a program or product name establish what DHS does with that system.
It also remains unclear precisely how the information was obtained.
DHS's investigation may establish whether an agency account, an internal DHS environment, a contractor or another access point was compromised. For now, the hackers' description of the intrusion remains their account of events, while Okta maintains that its systems were not breached.
The exposure nevertheless represents a substantial security incident for a department responsible for immigration enforcement, border security, cybersecurity and federal investigations, with more than 41,000 personnel and contractor records now circulating outside government systems.