Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents

An unprecedented leak of Department of Homeland Security records has exposed details of much than 41,000 employees oregon contractors who enactment for the section and its constituent agencies. The records see email addresses, telephone numbers, and bureau addresses, but besides references to interior systems and delicate accusation connected undercover and surveillance programs. In all, the leak provides a representation of however DHS is organized and however it operates.

The records, which span DHS itself arsenic good arsenic 7 constituent agencies, including Immigration and Customs Enforcement and US Customs and Border Protection, were past updated connected August 19, 2026. The transparency nonprofit Distributed Denial of Secrets and cybersecurity researcher and writer maia arson crimew previewed the information to WIRED, which they accidental they obtained from a radical calling itself the Department of Peace.

DDoSecrets published the archive, which it calls "Icepick," connected Wednesday. In a property release, DDoSecrets says the information is from DHS's Okta login system. In a enactment with the files, the hackers wrote, “They person our information, truthful it's lone just that we person theirs.”

An Okta spokesperson tells WIRED that it is unaware of immoderate breach of its systems. “We are alert of this report. Okta is secure, and we person nary grounds our information oregon systems were compromised,” the spokesperson says.

The leak comes arsenic DHS has aggressively pursued its critics, seeking to unmask anonymous societal media users, get customer records connected protestors, and secure warrants for surveillance tools aimed astatine reporters. Since the commencement of the 2nd Trump administration, DHS and the national authorities person moved to fell DHS employees’ names and faces. The bureau has besides expanded its definition of “doxing”—a word that typically refers to publishing someone’s location code and different idiosyncratic details for malicious purposes—to encompass the work of basal facts astir nationalist employees, similar their names and titles.

The leak follows a breach successful which a radical of hackers known arsenic ShinyHunters claimed to person stolen idiosyncratic accusation connected astir each FBI worker and their families. Law enforcement agencies person arrested respective suspects and detained different who is alleged to beryllium portion of the group.

The DHS records are searchable connected a website crimew built. “I don't deliberation we should fto them scare america into not looking into them,” she tells WIRED.

DHS and DOJ did not respond to WIRED’s petition for comment. The FBI referred WIRED’s enquiry to DHS.

According to a WIRED investigation of the data, CBP staffers relationship for much than fractional of the records. ICE accounts for astir 10,000, astir a 3rd of them successful Homeland Security Investigations, ICE’s investigative wing. Another 6,200 beryllium to US Citizenship and Immigration Services, and astir 1,000 are tied to the Cybersecurity and Infrastructure Security Agency, much than fractional of them contractors. Altogether, the files screen astir a seventh of DHS’s workforce, revealing however DHS is structured, from elder enactment down to idiosyncratic migration agents and detention contractors.

Like astir ample organizations, DHS uses support groups to power entree to interior systems, according to the leaked records. Nearly everyone named successful the leak has entree to astatine slightest immoderate of these systems. At HSI, 39 employees crossed much than a twelve tract offices beryllium to groups whose names see “CUC,” which authorities tribunal filings accidental stands for “certified undercover operation.” Another group, seemingly based successful HSI's St. Paul, Minnesota country of operations, references "Keyhole," which national tribunal filings picture arsenic a certified undercover cognition that precocious funded HSI's undercover surveillance of Minneapolis protestation groups earlier this year. Others notation a “Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program” for wiretaps, and an “Illicit Sensor Intercept Program (ISIP).”

The names of the groups—there are implicit 55,000 successful all—appear to notation tools for accessing migration tribunal records, pulling information from seized phones, and conducting surveillance. These see Palantir’s Falcon investigative level and PenLink, which analyzes telephone records and societal media.

Two support groups, named “Executive Leadership” and “AI Access,” look to database radical fixed exceptions to DHS's web filter, which blocks immoderate websites for employees. They incorporate the aforesaid 13 people, including erstwhile DHS caput Kristi Noem; Antoine McCord, the precocious departed DHS main accusation serviceman who has returned to defence tech institution Anduril; Philip Hegseth, listed arsenic a elder advisor to the DHS caput and the younger member of defence caput Pete Hegseth; and Jayce Krachenfels, listed arsenic a argumentation adviser, who antecedently worked arsenic a determination tract manager for Donald Trump’s 2024 statesmanlike campaign, according to his LinkedIn profile.

Other groups named successful the leak notation AI tools, including OpenAI’s ChatGPT, Google’s Gemini, and Microsoft’s Copilot. One, called “Grok.com,” includes 8 DHS exertion officials, including the department’s erstwhile main accusation serviceman and main information officer.

“If authentic and current, this is an extraordinarily invaluable quality assets for those seeking to penetrate DHS,” says Alexander Leslie, a nationalist information adept astatine the menace quality institution Recorded Future. “This dataset becomes mode much invaluable erstwhile correlated with antecedently compromised information, commercialized data, and different quality collections. An adversary could walk months exploiting these relationships to place susceptible personnel, make convincing impersonation attempts, oregon compromise ongoing investigations.”

More than 700 accounts are associated with a radical seemingly referencing Signal, the encrypted messaging app, astir each belonging to CBP personnel. More than 200 CBP accounts beryllium to a radical referencing Mobile Fortify, a look designation app migration agents usage to place people. The radical includes tract supervisors, peculiar effect squad operators, and tactical and quality agents. About fractional are successful Texas, California, and Arizona.

Roughly 1,300 ICE enforcement accounts person been created since July 4, 2025, erstwhile Trump signed the One Big Beautiful Bill Act, which funded the hiring of 10,000 caller ICE Enforcement and Removal officers by the extremity of 2025.

Nearly 20 accounts look to beryllium to unit with the Department of Defense, which the medication styles arsenic the Department of War; 8 are successful a radical titled “ICE Tip Line DOW Surge.” About 170 accounts are listed arsenic providing “military processing support” astatine ICE facilities, and 35 others explicitly place National Guard members.

Dozens of accounts person occupation titles similar “Designated Immigration Officer” and “287(g) Officer,” which people section instrumentality enforcement unit authorized to transportation retired immoderate migration enforcement duties. Many database county sheriff's offices and jails arsenic their workplaces. The records besides see astir 4,400 “associates,” whose jobs scope from IT developers and information scientists to nurses and detention officers. Of those, 145 are named arsenic a “contractor” oregon “high hazard contractor.”

More than 300 records notation elder titles associated with DHS headquarters, from Noem down done lawman undersecretaries, adjunct secretaries, and chiefs of unit to officials overseeing intelligence, technology, biometrics, and privacy. Most records besides sanction a supervisor, which could let anyone analyzing the dataset to reconstruct reporting relationships crossed the department.

The Trump medication has prosecuted protesters for posting accusation astir idiosyncratic ICE officers and warned others for doing so. In June, 15 Minnesota residents were charged nether laws related to stalking and threats of violence, which prosecutors linked to their information successful ICE-opposition activities. More than 100 HSI agents, including undercover operatives, took portion successful an cognition that included wide surveillance and infiltration of radical chats.

Adam Steinbaugh, a elder lawyer astatine the nonprofit civilian liberties radical FIRE, says that the Trump medication has taken an expansive presumption of 18 USC 119, a instrumentality that prohibits radical from sharing “restricted idiosyncratic information” astir national officers oregon their families with the intent to endanger them.

"This is accusation that would beryllium connected a concern card,” says Steinbaugh of the names and basal enactment details included successful the archive. “That's not thing the authorities tin criminalize."

Despite the imaginable sensitivity of different records successful the leaked data, the creators of Icepick bash not see it doxing. They spot it arsenic an accountability tool.

“The DHS particularly arsenic an bureau wholly lacks accountability, contempt galore parts of it being incredibly unpopular. The radical who enactment determination cognize this too, for illustration immoderate of their LinkedIn bios simply accidental ‘stuff astatine US Government,’” says crimew. “If they weren't hiding their engagement successful the repressive limb of the US authorities determination would beryllium nary request for america to exposure them successful the archetypal place.”