DHS Investigates Potential Breach After 41,000 ICE, CBP and CISA Staff Records Published Online

The Department of Homeland Security says it is looking into a potential breach after a searchable directory of more than 41,000 of its employees and contractors went online on October 28. The records name staff at ICE, CBP, Homeland Security Investigations, USCIS and CISA, with titles, offices, work phone numbers, email addresses, managers and the internal access groups each person belongs to. Some of those groups point to undercover and surveillance work.

The files were posted by Distributed Denial of Secrets, the nonprofit leak archive, under the name Icepick. It says a hacktivist group calling itself the Department of Peace pulled the data from an Okta single sign-on service that DHS uses. A companion search tool went up the same day. Anyone can download the set.

Seal of the US Department of Homeland Security, public domain via Wikimedia Commons

What is in the files

The breakdown reported so far runs like this. CBP, Border Patrol included, accounts for more than 20,000 records, about half the set. ICE has roughly 10,000. USCIS has about 6,200 and CISA nearly 1,000. The data also lists more than 55,000 permission groups, the labels that decide who can open which internal system. WIRED found 39 HSI employees in groups marked “CUC,” a term federal court records tie to certified undercover operations. Other group names refer to wiretaps, phone data analysis and commercial location tracking tools.

None of this is classified material in the usual sense. It’s a staff directory with an org chart attached. That is the problem. A directory tells an outsider who works where, who reports to whom and which people hold access to sensitive systems, which is exactly what a phishing crew or a foreign intelligence service would want before trying to get inside.

Reuters could not verify the whole set or the Okta claim, but it matched six named employees against credit bureau and dark web breach data and confirmed details directly with three DHS staff. One said it was the first they had heard of any breach. Fox News said it confirmed that several undercover ICE agents are named.

What DHS and Okta say

DHS gave a two-line statement: it is aware of a potential breach, it is working to address it swiftly and effectively, and it will update the public when it knows more. The department has not said how the data left its systems, how many people it will notify or whether it has called in the FBI.

Okta says its systems are secure and it has no evidence that its data or systems were compromised. Both statements can be true. A single sign-on service holds the list of every user and every group in an agency’s account, and a stolen administrator login or a leaked access token with read rights can export that list without anyone breaking Okta itself. Okta’s government cloud has held FedRAMP High authorization since 2023. FedRAMP vets the vendor. It doesn’t vet how each agency guards its own admin credentials.

So far neither side has published anything that settles the question. Until DHS does, the Okta claim rests on the leakers’ word.

Third exposure of DHS staff this year

This is the third time in 2026 that DHS personnel or business data has been dumped in public. In January, about 4,500 ICE and Border Patrol employees were posted on ICE List, a site run from the Netherlands, after an ICE agent shot and killed Renée Good in Minneapolis. The site’s owner said a DHS whistleblower supplied the data. DHS said then that whoever was responsible would be charged. In March, the same Department of Peace group released contract data from DHS’s Office of Industry Partnership covering more than 6,000 companies, also through Distributed Denial of Secrets.

Each time, the group behind the release framed it as accountability. This time it said DHS employees “have our information, so it’s only fair that we have theirs.” The archive’s co-founder, Emma Best, said the search tool would help journalists, records requests and congressional oversight.

Congress has a bill on the shelf. Senator Marsha Blackburn’s Protecting Law Enforcement from Doxxing Act, S. 1952, introduced in June 2025, would make it a federal crime, with up to five years in prison, to publish a federal law enforcement officer’s name with intent to obstruct a criminal investigation or an immigration operation. It hasn’t left committee. Critics say it could chill reporting on public employees. A leak this size will put it back on the table either way.

Reuters called the DHS release the third major government data leak in about a month, after a September claim by the ShinyHunters group that it took FBI employee records, and a class action filed last week over a Pentagon breach of military personnel data.

The awkward detail sits in the CISA numbers. The agency that tells the rest of the government how to lock down identity systems is in the dump with nearly 1,000 of its own staff. Its own rulebook is late too: the incident reporting rule it owes under the 2022 law only reached the White House budget office on October 1, a year behind schedule, as our post on the cyber information-sharing stopgaps laid out. For the roughly 10,000 ICE names, the exposure lands in the middle of the arrest drive covered in our post on the 1,000-a-day target.

What to watch: whether DHS confirms the access route, whether the Inspector General opens a review, and whether either chamber’s homeland security committee calls a hearing before the December 11 funding deadline.