Dhs Employee Data Leak Exposes More Than 40,000 Records
A hacker published Homeland Security personnel records, exposing work contact details and information about employees’ access to internal systems.
A hacker has published records concerning more than 40,000 Department of Homeland Security employees and contractors, exposing work contact details and information about access to internal systems. The data covers DHS and agencies including Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE), according to TechCrunch and WIRED.
Table of Contents
What the records contain
The files include names, job titles, email addresses, phone numbers and office locations. TechCrunch says the hacker, who uses the name Department of Peace, claimed to have obtained the records from an Okta single sign-on system used by DHS personnel and contractors. WIRED reports that the records were last updated on August 19, 2026; TechCrunch says record timestamps suggest the data was taken around mid-August.
TechCrunch estimates that about 21,000 records concern CBP employees, while another 10,000 relate to ICE and its Homeland Security Investigations (HSI) unit. WIRED also puts ICE’s total at about 10,000 and identifies roughly 6,200 records tied to U.S. Citizenship and Immigration Services. The Verge, by contrast, describes nearly 7,000 records as belonging to ICE staff. The outlets do not use the same breakdown for ICE and HSI.
The data passed through cybersecurity researcher and journalist maia arson crimew to Distributed Denial of Secrets, which published the archive under the name “Icepick,” according to TechCrunch and WIRED. TechCrunch says it checked a portion of the records against the names of known DHS employees.
Internal access details raise further concerns
Beyond directory information, the leak contains names of groups used to manage access to software and internal resources. WIRED says some HSI groups refer to undercover operations and interception programs, while other groups reference tools including PenLink, which analyzes phone records and social media. TechCrunch reports that the records show which internal applications and systems some employees were permitted to use.
Those references indicate how access was organized; they do not, on their own, establish how any individual used a tool. A national security expert quoted by WIRED warned that, if the records are authentic and current, combining them with other information could help an adversary identify personnel for impersonation attempts or other targeting.
What DHS and Okta said
After TechCrunch published its report, a DHS spokesperson told the outlet that the department was aware of a potential breach and was working to address it. DHS had not responded to requests for comment from The Verge or WIRED when their reports were published.
Okta told TechCrunch and WIRED that it was aware of the report but had no evidence its own data or systems were compromised. TechCrunch says it remains unclear whether DHS knows how the records were taken or whether the weakness that allowed the theft has been fixed.
Sources
This story was compiled by AI from the reports below. Read the originals for the full details.