Hackers expose 40,000 ICE and DHS agents

Over 40,000 DHS records stolen, leaving thousands of ICE and CBP agents exposed. A massive data leak at the Department of Homeland Security (DHS) has exposed the identity, job titles, and employment information of 41,191 federal employees and contractors in the United States. The cyberattack represents a severe setback for the agencies tasked with carrying out President Donald Trump's administration immigration offensive, revealing the names of thousands of agents from Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP) who typically operate under strict anonymity.

The scope of the "Icepick" leak

The file, named "Icepick" and weighing approximately 166.7 megabytes, was published on October 28 by the transparency collective Distributed Denial of Secrets (DDoSecrets) after being stolen by a group of hacktivists calling themselves "Department of Peace." The records cover personnel from nine DHS divisions with data updated through August 19, 2026.

According to the analysis of the leaked files, the exposure mainly affects the operational and security branches:

• Customs and Border Protection (CBP): More than half of the database belongs to this agency, with nearly 20,000 to 21,000 identified officers and border patrol agents.
• Immigration and Customs Enforcement (ICE): Around 10,000 agents and employees are listed, including deportation officers and investigators.
• Cybersecurity and Infrastructure Security Agency (CISA): Approximately 980 personnel records were exposed, of which more than half belong to external contractors.

Although Emma Best, co-founder of DDoSecrets, clarified that the file does not contain residential addresses, private phone numbers, or passwords, the database exposes full names, institutional emails, office phone numbers, headquarters locations, and each official's chain of command.

The most sensitive aspect for operational security lies in the leak of more than 55,000 internal permission groups detailing which tools and programs each employee uses. Among the compromised data are 39 Homeland Security Investigations (HSI) agents assigned to certified undercover operation groups (CUC), ICE use-of-force instructors, and more than 200 CBP accounts linked to the Mobile Fortify facial recognition app. Likewise, the access map reveals which officials operate advanced analysis and surveillance systems such as Palantir Falcon, Cellebrite, and PenLink.

Political motivation and controversy over anonymity

The "Department of Peace" group claimed responsibility for the intrusion, stating it acted in response to statements made in July by DHS Secretary Markwayne Mullin about intensifying raids and deportations. In a note attached to the files, DDoSecrets justified the disclosure by pointing out that, since the government possesses citizens' information, it is only fair that the public knows that of the officials.

The publication has reignited an intense national debate. During recent immigration operations, numerous ICE agents have used balaclavas and face masks to hide their faces, a measure the government defends to protect officers and their families against threats, harassment, or retaliation. Meanwhile, civil rights organizations argue that knowing the internal structure of the agency facilitates public oversight and the investigation of potential abuses of authority.

Ongoing investigation and security risks

The authors of the theft claimed to have extracted the information through a DHS-used Okta single sign-on directory. However, Okta denied that its platform was breached and stated it has no evidence of an intrusion into its systems, leaving the exact access path under investigation.

DHS confirmed it is aware of the security breach and initiated immediate actions to protect its staff, including legal requests through the firm ZeroFox to take down a search web portal created by researcher Maia Arson Crimew. Cybersecurity specialists warn that the combination of work emails, exact titles, and internal programs exposes thousands of federal employees to highly targeted phishing campaigns.