Leak exposes 41,000 DHS workers, including undercover ICE agents

A massive leak has exposed details on more than 41,000 Department of Homeland Security (DHS) workers and contractors, including email addresses, phone numbers and office locations, with substantial references to undercover and surveillance programmes. The records, spanning DHS and seven component agencies such as Immigration and Customs Enforcement (ICE) and US Customs and Border Protection (CBP), were last updated on 19 August 2026.

The data were published by the transparency nonprofit Distributed Denial of Secrets (DDoSecrets) and a researcher-turned-journalist known as maia arson crimew, who say they obtained the files from a group calling itself the Department of Peace. DDoSecrets describes the archive as “Icepick” and attributes the data to DHS’s Okta login system, though Okta has said it is unaware of any breach of its systems.

Analyses from WIRED indicate that CBP accounts for just over half of the records, ICE about 10,000 entries (roughly a third in Homeland Security Investigations), with another 6,200 linked to USCIS and nearly 1,000 to the Cybersecurity and Infrastructure Security Agency (CISA). The leak reveals permission groups and internal tools mapped to DHS operations, including references to Palantir’s Falcon and PenLink for data analysis and surveillance.

Among the groups named are those tied to “certified undercover operation” (CUC), “Keyhole” operations linked to undercover surveillance, and several programmes related to wiretaps and data access. The dataset also lists hundreds of accounts linked to encrypted messaging and facial recognition tools, alongside multiple senior DHS figures, suggesting potential pathways for credential misuse and social engineering, should the information be exploited.