The material was handed to Distributed Denial of Secrets, which posted it in a searchable database called Icepick. DHS has acknowledged a potential breach and says it is investigating, but it has not said how the data was obtained or given a timeline for updates.
The files include names, agency email addresses, workplace locations, phone numbers (some identified as cell phones), supervisors, and internal access-group memberships. It has not been established that private home addresses are in the data. The records were last updated on Aug. 19, so some assignments may have changed, but that also means roughly two months passed between the alleged theft and public disclosure. How long DHS knew, or didn’t, is an open question.
The breakdown by agency shows where the exposure concentrates:
- Customs and Border Protection accounts for more than half of the records
- About 10,000 records involve Immigration and Customs Enforcement
- Another 6,200 are tied to U.S. Citizenship and Immigration Services
The Leak Maps Who Works Undercover and What They Use
WIRED identified 39 Homeland Security Investigations employees linked to access groups that reference certified undercover operations. The records also show job titles, assignments to special and undercover operations, surveillance, and computer forensics, plus the tools involved, including Cellebrite and Palantir. Some access groups point to surveillance technology and artificial intelligence tools.
For undercover personnel, a name matched to an operational assignment can compromise an investigation and put the person at risk. Families now face heightened safety concerns as well.
The group behind the breach, calling itself the Department of Peace, framed the leak as retaliation. DHS employees “have our information, so it’s only fair that we have theirs,” it said.
Okta Says Its Platform Wasn’t Broken
The hackers claim they got the data by exploiting Okta, the single sign-on provider DHS and many other organizations use. Okta says it knew of the claims but that its systems were secure and it has no evidence its platform was compromised.
Based on what is public today, this does not look like attackers breaking Okta itself. It looks more like the problem that dominates enterprise security now: someone may have been able to authenticate as a legitimate user. Exactly how the DHS credentials were obtained is unknown, and until DHS releases forensic details, anyone claiming to know the mechanism is guessing.
The directory itself is the weapon in the meantime. A phishing email that names a real supervisor and includes a valid work phone number is far more believable, and a government database becomes a targeting list once it is combined with details scraped from public sources. Federal agents now face targeted phishing that could compromise government systems and, eventually, the personal information of citizens that DHS holds. The pattern echoes earlier FBI personnel breaches.
The database covers about a fifth of a workforce of just over 220,000, so thousands more personnel could be at risk if the breach goes beyond what is documented. Icepick has already been mirrored across multiple servers, which makes containment uncertain at best.
Hashlytics Take
The Okta denial and the hackers’ claim can both be true, and that is the uncomfortable part. If valid credentials were used, no vendor patch fixes it, because the failure sits in how DHS verifies who is signing in and what a signed-in account can see. An employee directory that carries supervisors, phone numbers, and access groups tied to surveillance and undercover programs is a lot to expose to any single login. The leak’s lasting damage is also not the contact details, which can be changed. It is the relationships between people, tools, and assignments, which cannot be quietly rotated like a password.
Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates
