Personal and work details for more than 41,000 Department of Homeland Security employees and contractors, including immigration agents assigned to undercover work, have been posted online by a hacking group calling itself the “Department of Peace,” according to reporting by WIRED, NPR, the BBC and SecurityWeek.
The records include names, work email addresses, phone numbers, job titles and office locations, along with entries showing which internal systems each account could reach, SecurityWeek reported. WIRED reported that the files were last updated on August 19, 2026, and that the transparency group Distributed Denial of Secrets published the archive on Wednesday under the name “Icepick.”
Massive data breach exposes 40,000 US Homeland Security employees https://t.co/VHt4YIVqBn pic.twitter.com/NKGSrQ33VS
— New York Post (@nypost) October 29, 2026
More than 21,000 of the records belong to U.S. Customs and Border Protection personnel, according to NPR, and roughly 10,000 relate to Immigration and Customs Enforcement and its Homeland Security Investigations unit. WIRED reported that the trove also covers about 6,200 people at U.S. Citizenship and Immigration Services and nearly 1,000 tied to the Cybersecurity and Infrastructure Security Agency.
Agents who work undercover are on the list
The leak goes beyond a phone directory. According to WIRED, the records reference sensitive undercover and surveillance programs, and about 35 accounts explicitly identify National Guard members supporting immigration work. Dozens of entries carry titles such as “287(g) Officer,” which marks local sheriff’s deputies and jail staff authorized to assist with immigration enforcement, WIRED reported.
The BBC reported that the files also include dozens of previously unknown operation names and the agents who led and worked on them. Distributed Denial of Secrets co-founder Emma Best told the BBC the goal was to replace “anonymity with accountability.”
Exposing the identities of the officers who carry out immigration enforcement raises obvious safety concerns for those officers and their families, at a time when federal agents have faced protests, threats and attacks tied to their work. The group made its motive plain. In a note included with the files, the hackers wrote, “They have our information, so it’s only fair that we have theirs,” according to WIRED and SecurityWeek.
DHS responds; Okta denies a breach
DHS said in a statement that it was “aware of a potential breach and is actively working to address the situation swiftly and effectively,” NPR reported. The department added that it is taking steps to make sure its people are protected, according to NPR.
The hackers claimed they got in through the single sign-on system DHS uses from the identity company Okta, according to SecurityWeek. Okta disputed that. “Okta is secure, and we have no evidence our data or systems were compromised,” a company spokesperson told WIRED and SecurityWeek.
NPR reported that a U.S.-based journalist, Ryan Ottignon, and a Swiss hacker known as maia arson crimew built a searchable online version of the data, with crimew doing the technical work. NPR described the leak as coming on the heels of similar hacking attacks at the FBI, and the BBC reported it is the third time in recent weeks that a government agency has been targeted by leaks or hacks.
The data covers only part of the department. NPR said the records represent about a fifth of DHS’s workforce of a little more than 220,000 people, while WIRED put the share at roughly a seventh.
No arrests or suspects have been publicly announced, and DHS has not said how the data was taken. Daily Beltway will update this story as officials release more information.
Sources
- WIRED: “Massive Leak Exposes 41,000 Homeland Security Workers, Including Undercover ICE Agents”
- NPR: “Hackers expose the identities of more than 40,000 DHS employees”
- BBC News: “Details of thousands of US immigration agents leaked in major hack”
- SecurityWeek: “Over 41,000 DHS Employee Records Leaked Online”
- New York Post on X
Sources cited
Sources
- Original post: New York Post (@nypost) on X, Oct 29, 2026
Posts on X are shown as published by their authors; claims in them are attributed, not independently confirmed unless the article says so. If an embedded post does not load, these links open the originals.