Hackers leak data on 41,000 Homeland Security workers, exposing undercover ICE agents and surveillance operations

Key Highlights

• 41,000+ DHS workers exposed: Leaked records include employee names, cellphone numbers, email addresses, office locations, and job titles.
• Undercover agents identified: The data reveals personnel connected to ICE, CBP, surveillance programs, human intelligence, and undercover operations.
• Palantir and Grok connections revealed: Internal records identify groups associated with Palantir software, xAI’s Grok chatbot, and wiretap programs.
• Hackers claim access through Okta: The group behind the leak claims the records came from DHS’s Okta login system. Okta says it has no evidence its systems were compromised.
• DHS investigating: The department acknowledges a potential breach, as Reuters independently verifies portions of the leaked records.

Hackers have exposed sensitive records belonging to more than 41,000 employees and contractors of the U.S. Department of Homeland Security (DHS), revealing details about undercover ICE agents, surveillance operations, and internal government systems, according to multiple reports. The massive data leak offers an unusually detailed look inside one of America’s most sensitive federal agencies, raising concerns about employee safety, operational security, and the government’s ability to protect its own information.

The leaked records, first examined by WIRED and independently investigated by Reuters, include employee names, email addresses, cellphone numbers, office locations, job titles, and internal group memberships. Some records identify personnel assigned to undercover investigations, human intelligence operations, computer forensics, and electronic surveillance.

“An unprecedented leak of Department of Homeland Security records has exposed details of more than 41,000 employees or contractors who work for the department and its constituent agencies,” WIRED reported.

“The leaked records include the locations of ICE and CBP facilities, workers’ cell phone numbers, and the members of groups tied to wiretap programs, Palantir software, and xAI’s Grok chatbot,” the report says.

The exposure reaches across DHS and seven component agencies, including Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), Homeland Security Investigations (HSI), and the Cybersecurity and Infrastructure Security Agency (CISA).

According to WIRED, the records were last updated on August 19, 2026, suggesting the archive contains relatively recent information about the department’s workforce and internal structure.

The transparency nonprofit Distributed Denial of Secrets (DDoSecrets) published the archive on Wednesday under the name “Icepick.” The organization said it received the material from a hacking group calling itself the Department of Peace, which previously claimed responsibility for obtaining DHS documents related to government contractors.

In a statement accompanying the files, the hackers offered a blunt explanation for their actions: “They have our information, so it’s only fair that we have theirs.”

Leak reveals DHS surveillance programs and ties to Palantir and Grok

What makes this incident particularly concerning is the type of information exposed. The records go beyond an ordinary employee directory, revealing internal relationships, operational assignments, and access to sensitive government technologies.

WIRED found references to wiretap programs, surveillance tools, immigration databases, and internal groups associated with software from Palantir and xAI’s Grok chatbot. The records reportedly identify employees connected to these systems, offering clues about how DHS uses these technologies.

These references do not establish that Palantir or xAI systems were compromised. Instead, the records appear to reveal which government personnel or groups were associated with particular tools and programs.

That distinction matters. A leaked employee directory can expose contact information. A directory containing internal access groups and operational assignments can reveal how an organization functions, which employees handle sensitive work, and where attackers might focus future efforts.

Such information could help criminals impersonate government employees, launch targeted phishing campaigns, or identify individuals involved in confidential investigations.

DDoSecrets co-founder Emma Best said cybersecurity researcher and journalist maia arson crimew developed a searchable interface for the archive. The publishers argue that making the information accessible could support journalism, public records requests, and congressional oversight.

The release has raised competing concerns about government accountability and the potential risks to employees whose information has been exposed.

DHS investigates possible breach as Okta denies compromise

The source of the leaked information remains disputed.

DDoSecrets claims it obtained the records through the Okta single sign-on service used by DHS. Okta, which provides identity and access management software to organizations, rejected suggestions that its own infrastructure had been breached.

“Okta is secure, and we have no evidence our data or systems were compromised,” the company told Reuters.

The statement leaves an important question unanswered: how did the attackers obtain access to such a large collection of government records?

A compromise involving an agency account, improperly secured access, or another internal weakness could potentially expose information without a breach of Okta’s underlying systems. Investigators have not publicly established which, if any, of those scenarios occurred.

DHS acknowledged the incident, telling Reuters it was “aware of a potential breach and is actively working to address the situation swiftly and effectively.”

The department said it was taking steps to protect affected employees and would provide further information when available.

Reuters could not independently authenticate the entire archive. Its reporters did, however, match personal details belonging to six DHS employees against other records and directly confirmed contact information with three employees. One worker reportedly learned about the incident only after Reuters contacted them.

The disclosure is the third major U.S. government data exposure to draw attention within a month. In September, the hacking group ShinyHunters claimed it stole sensitive FBI employee information. More recently, the Defense Department faced a class action lawsuit following a separate breach involving millions of current and former military personnel.

The latest incident raises a broader security question for federal agencies increasingly dependent on shared identity platforms, interconnected databases, and outside technology providers.

Protecting individual systems is one challenge. Preventing a single collection of internal records from revealing an agency’s personnel, technical relationships, and sensitive operations is another.

For DHS, the immediate concern is determining how the information was obtained and whether the exposure puts employees or ongoing investigations at risk. The longer-term concern is what the leaked records reveal about the security of the federal government’s internal digital infrastructure.