What information was included in the DHS data leak?
The leaked database, titled Icepick, contains sensitive personal and professional data for over 41,000 Department of Homeland Security employees. The breach provides a detailed look into the identities and operational roles of personnel across several high-stakes federal agencies. According to the leaked data, the vast majority of the affected individuals work for Customs and Border Protection (CBP), with more than 21,000 agents identified. Approximately 6,600 personnel from Immigration and Customs Enforcement (ICE) are also included in the records.
Beyond basic contact information such as names, work addresses, and telephone numbers, the leak provides deeper insights into the agency's internal workings. The data includes descriptions of the specific duties performed by various staff members. Furthermore, the breach has exposed dozens of previously unknown operation names, identifying the specific agents who led or participated in these missions. This level of detail also extends to the technical tools utilized by these officers, including technology provided by companies such as Palantir and Cellebrite.
Agencies affected by the breach
While CBP and ICE represent the largest groups of affected personnel, the breach is not limited to immigration enforcement. The leaked records include staff from several other DHS components, including:
- Homeland Security Investigations (HSI)
- The Federal Protective Service (FPS)
- The Cybersecurity and Infrastructure Security Agency (CISA)
The inclusion of CISA personnel is particularly notable given that the agency is tasked with defending the nation's critical infrastructure and cybersecurity landscape.
How was the DHS information accessed and released?
The breach was orchestrated by a group calling itself the Department of Peace, which claimed to have accessed the DHS profiles through a single sign-on (SSO) service known as Okta. Okta is a widely used security platform designed to manage user identities and ensure that only authorized personnel can access internal organizational systems. While the hacking group pointed to this specific vulnerability, Okta has responded to the claims by stating that its systems remain secure and that they have found no evidence of a compromise to their own data or infrastructure.
The information was subsequently made public online by cybersecurity researcher and journalist maia crimew, alongside the website Distributed Denial of Secrets (DDoSecrets). The group behind the leak stated that their objective was not to create a comprehensive directory of every DHS employee, but rather to replace "anonymity with accountability." Emma Best, a co-founder of DDoSecrets, characterized the leak as an extraordinary event that identifies officials responsible for covert operations and deportation programs.
Why is this hack being linked to political tensions?
The Department of Peace has explicitly linked their cyber actions to the political environment surrounding US immigration policy and the leadership of the Department of Homeland Security. A spokesperson for the group made a direct reference to statements made by Secretary of Homeland Security Markwayne Mullin. The group noted that Mullin, who took office in March, had previously stated he was "turning up the heat," suggesting that the hack is a direct consequence of the administration's aggressive stance on immigration.
This cyberattack occurs against a backdrop of intense public scrutiny and backlash regarding the Trump Administration's immigration enforcement strategies. Since President Donald Trump returned to office in 2025, the US has carried out nearly 1 million deportations, according to data from the Migration Policy Institute. The data indicates that more than 70% of these deportations involved individuals with no criminal record, a fact that has fueled significant domestic criticism of the administration's methods.
What is the impact of recent violence in immigration enforcement?
The leak follows a period of increased physical volatility during immigration operations. This year, ICE agents have been involved in several violent encounters, including shooting at more than two dozen people. These incidents have resulted in at least nine deaths. The high-profile deaths of Alex Pretti and Renee Good in Minnesota have become focal points for critics, as both individuals were reportedly shot and killed by ICE agents despite not being the intended targets of arrest operations.
These incidents have contributed to a broader debate regarding the transparency and conduct of immigration officers. Critics frequently point out that agents often carry out enforcement actions while wearing masks and sunglasses to obscure their identities. Although law requires agents to identify themselves, there have been frequent public and political demands for more stringent enforcement of these identification requirements to ensure officer accountability during field operations.
How does this breach fit into a pattern of government hacks?
This incident marks the third significant government-related leak or hack in recent weeks, highlighting a period of heightened vulnerability for US federal agencies. The cybersecurity landscape for the US government has seen a series of rapid-fire breaches involving different agencies and different actors.
- The FBI: Last month, the FBI was targeted by a group known as ShinyHunters, which successfully accessed the personal information of thousands of agents.
- The Federal Election Commission (FEC): In recent days, the FEC was taken offline following what is suspected to be a hacking attempt.
- The DHS: The current breach involving 41,000 personnel represents a massive scale of data exposure for a single agency.
A DHS spokesperson confirmed that the agency is aware of the potential breach and is working to address the situation. The agency has stated it is taking all security threats against its officers seriously and will provide updates as more information becomes available.
Frequently asked questions
Which agencies are most affected by the DHS leak?
Customs and Border Protection (CBP) is the most heavily impacted agency, with over 21,000 personnel identified in the leak. Immigration and Customs Enforcement (ICE) follows with approximately 6,600 members affected. Other agencies involved include Homeland Security Investigations and the Cybersecurity and Infrastructure Security Agency.
What specific data was leaked in the Icepick database?
The leaked information includes names, work addresses, and phone numbers of DHS staff. It also contains detailed job descriptions, the names of agents involved in specific covert operations, and information regarding the specific technologies, such as those from Palantir, used by these officials.
Did Okta suffer a security breach?
While the Department of Peace claimed they used the Okta single sign-on service to access DHS records, Okta has officially denied that its systems were compromised. The company stated that it has found no evidence that its own data or security infrastructure was breached during this incident.
What is the political motivation behind the Department of Peace hack?
The group claims their goal is to replace "anonymity with accountability" for officials overseeing deportation and undercover operations. They have specifically linked their actions to the aggressive immigration policies and rhetoric employed by the current DHS leadership and the Trump Administration.
How many deportations have occurred under the current administration?
According to data from the Migration Policy Institute, the US has enacted nearly 1 million deportations since President Donald Trump returned to office in 2025. Notably, more than 70% of those deported had no criminal record.
Key takeaways
- More than 41,000 DHS personnel, primarily from CBP and ICE, had their data leaked.
- The leaked "Icepick" database includes names, contact details, and undercover operation names.
- The Department of Peace claims the breach was facilitated through the Okta SSO service.
- The leak coincides with a period of intense immigration enforcement and nearly 1 million deportations.
The evolving landscape of federal cybersecurity and accountability
The massive leak of DHS personnel data represents a significant intersection of cybersecurity failure and political volatility. By exposing the identities and operational methods of immigration agents, the breach moves beyond simple data theft into the realm of active political disruption. As the US government grapples with a series of high-profile hacks—ranging from the FBI to the FEC—the ability to protect sensitive personnel information remains a critical vulnerability. Whether this leak leads to increased accountability for undercover operations or poses a direct physical threat to federal officers remains a central point of contention in the ongoing debate over US immigration policy.
