- A hacktivist group has published personal information for over 41,000 U.S. Department of Homeland Security (DHS) employees online.
- The leaked data includes names, job titles, phone numbers, email addresses, office locations, and references to internal systems.
- Personnel from various DHS agencies, including Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP), are affected.
Massive Data Leak Exposes Thousands of DHS Personnel Details
A hacktivist group has published sensitive data belonging to more than 41,000 employees and contractors of the U.S. Department of Homeland Security (DHS). This incident, resulting from a cybersecurity breach, has led to the exposure of a vast array of personal information, raising significant concerns about the security of government personnel.
Details of the Exposed Information
Reports indicate that the leak encompasses details such as names, job titles, phone numbers, email addresses, and office locations of the affected individuals. Furthermore, the published records contain references to internal DHS systems and potentially sensitive information related to undercover operations and surveillance programs. This data, according to sources, provides insight into the Department’s organizational structure and operational methods.
The compromised records span DHS itself as well as seven of its component agencies, including critical entities like U.S. Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP).
Source and Motivation Behind the Attack
The data was reportedly obtained by a group identifying itself as the “Department of Peace” and subsequently shared with the transparency nonprofit Distributed Denial of Secrets (DDoSecrets) and cybersecurity researcher and journalist maia arson crimew. DDoSecrets published the archive, dubbed “Icepick,” on Wednesday. In a press release, DDoSecrets stated that the data originated from DHS’s Okta login system. The hackers included a note with the files, asserting, “They have our information, so it’s only fair that we have theirs,” suggesting a potential motive of retribution for government surveillance. Recent reports on cyberattacks highlight the evolving tactics and motivations of such groups.
Timeline and Data Currency
The records were last updated on August 19, 2026, and were previewed by WIRED. A data breach of this magnitude underscores the increasing cybersecurity risks faced by government agencies and the critical importance of protecting employee personal information.
This extensive data leak concerning U.S. Department of Homeland Security employees highlights the critical vulnerability of government entities to cyberattacks, particularly from hacktivist groups. For the affected personnel, this means an elevated risk of phishing, identity theft, and other forms of social engineering, as their personal and professional details are now publicly accessible. For organizations, it serves as a stark reminder of the continuous need to bolster cybersecurity measures, including multi-factor authentication, regular system audits, and robust employee training. The incident also underscores the potential geopolitical motivations behind such attacks, where information disclosure is used as a tool for pressure or retaliation.
Managing our team’s Okta deployment has shown me that while centralizing directory info works great for SSO, directory sync settings often expose too much by default. Review your user schema attributes and immediately restrict read permissions on sensitive custom fields.