On this page · 5 sections ▾
Records on more than 41,000 employees and contractors of the US Department of Homeland Security were published on October 28, 2026, in an archive called "Icepick." According to Wired, the nonprofit Distributed Denial of Secrets (DDoSecrets) released the data, which it says came from DHS's Okta login system. DHS said it is aware of a potential breach, while Okta said it has no evidence its systems were compromised.
Key facts
- The records include names, job titles, work emails, phone numbers and office locations, and were last updated on August 19, 2026.
- Wired counted about 10,000 ICE records, 6,200 at US Citizenship and Immigration Services and nearly 1,000 at CISA. CBP accounts for more than half.
- Wired says the data covers about a seventh of the DHS workforce. TechCrunch puts it at about one-fifth of roughly 220,000 staff.
- A group calling itself the Department of Peace supplied the data. Its note read: "They have our information, so it's only fair that we have theirs."
- Researcher maia arson crimew built a searchable site for the records.
What the data reveals
Beyond contact details, the files list permission groups, more than 55,000 in all according to Wired, that show which internal systems staff can reach. Wired reports 39 HSI employees belong to groups tied to certified undercover operations, plus groups referencing wiretap and intercept programs.
Group names also point to tools such as Palantir's Falcon platform, PenLink, and the Mobile Fortify face-recognition app, which more than 200 CBP accounts are linked to. Other groups reference ChatGPT, Gemini and Copilot. TechCrunch adds that about 4,500 users sit in a group named "Headspace_users," though Headspace said it has provided no services to DHS or ICE since 2023.
Verification and disputes
The sources differ on some counts. The Next Web reports that BBC News counted nearly 6,600 ICE staff, below Wired's figure of about 10,000. The Verge cites nearly 7,000.
Verification is partial. TechCrunch matched several known employees against an offline copy of the database and said the data appears authentic. The Next Web, citing Reuters, says Reuters could not verify the whole trove but matched six named employees to other records and confirmed details with three by phone. Nextgov/FCW found some records appear historical, including CISA staff who have since left.
Okta's statement means the origin of the data remains unconfirmed. TechCrunch noted it is unclear whether the underlying vulnerability has been fixed.
Why it matters
Alexander Leslie of Recorded Future told Wired the data could be "an extraordinarily valuable intelligence resource" for adversaries if authentic and current. He warned it could be used to build impersonation attempts or compromise investigations, especially when combined with other leaked data.
Critics of DHS see a different value. Ryan Shapiro of Property of the People told TechCrunch that emails and phone numbers are indispensable for FOIA research. Adam Steinbaugh of FIRE told Wired that names and basic work details are "information that would be on a business card."
